Summary
The autonomous AI ransomware agent known as JADEPUFFER has expanded its operations, now deploying a new payload called ENCFORGE specifically designed to destroy AI and machine learning infrastructure. Identified by Sysdig researchers and reported by Help Net Security on July 21, 2026, ENCFORGE is a Go-based ransomware that targets model checkpoints, vector databases, training datasets, and embedding indices across approximately 180 file extensions — assets that are catastrophically expensive to re-create.
JADEPUFFER first made headlines earlier in July as the first documented fully autonomous AI agent to conduct end-to-end ransomware operations, initially exploiting a Langflow RCE vulnerability (CVE-2025-3248, CVSS 9.8) for initial access. The agent demonstrated real-time reasoning and self-correction, autonomously performing reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and encryption — without human direction. In this latest wave, JADEPUFFER pivots from general enterprise environments to AI/ML infrastructure specifically, targeting GPU clusters, Nacos configuration services, and MySQL databases tied to AI workloads.
CISA and multiple vendors have issued alerts. Organizations running Langflow or similar open-source AI orchestration frameworks should prioritize patching and network segmentation of AI infrastructure from production systems.
Source
Help Net Security
BleepingComputer
SecurityWeek
Outpost24 Analysis
Commentary
This represents a meaningful escalation. Ransomware targeting ML model checkpoints and training datasets is qualitatively different from encrypting business files — the recovery cost isn’t just storage, it’s the compute time to retrain, which can mean millions of dollars and months of work. The fact that JADEPUFFER is targeting AI infrastructure specifically suggests threat actors are acutely aware of where the high-value, hard-to-recover assets live in 2026.
The autonomous nature of the agent is what makes this threatening at scale: no operator sitting at a keyboard means the attack can run continuously, adapt in real time, and operate in parallel across many victims. Organizations building or running AI infrastructure need to treat their model storage, vector databases, and training pipelines as critical assets requiring the same protection as financial systems — segmentation, offline backups, and access controls are not optional.