It took 19 days for a fully autonomous AI attacker to go from flinging improvised Python scripts at a vulnerable Langflow server to deploying a compiled, purpose-built ransomware that zeroes in on model checkpoints, vector indices, and training datasets. The payoff isn’t a wire transfer—it’s pure destruction.
That timeline, laid out by Sysdig’s Threat Research Team in late July 2026, has turned conversations about AI security from hypothetical to brutally commercial. Rebuilding a single fine-tuned production model can cost anywhere between $75,000 and $500,000 in cloud GPU compute and engineering hours. When ENCFORGE locks up an organization’s .safetensors, .gguf, and .faiss files, the backups everyone talks about become a cruel joke. “Restoring a database from Friday’s snapshot costs a weekend of transactions,” one researcher noted. “Restoring a fine-tuned model costs everything learned since Friday, none of it stored as rows to replay.”
ENCFORGE is not the kind of malware that happens to bump into a stray .pth file while encrypting Office docs. It was built to hunt AI artifacts. The binary targets roughly 180 file extensions across the modern ML stack—PyTorch checkpoints, Hugging Face SafeTensors, llama.cpp GGUF quantized weights, FAISS vector indices, Apache Parquet training data, ONNX interchange files, NumPy arrays, and more. An --include flag lets operators tack on any extra globs; the built-in help text specifically name-drops LoRA adapters and legacy GGML weights. “That points directly at AI environments,” said Sysdig’s Michael Clark. “A generic file locker would have little reason to mention LoRA adapters.”
The payload sits on the attacker’s command-and-control server as /.lockd—a direct request returns 404, and the leading dot hides it from a casual directory listing. It’s a UPX 5.20-packed, static Go 1.22.12 ELF binary that carried zero detections on either the packed or unpacked hash at the time of analysis. Internally it calls itself encfile, with error messages referencing a companion keygen called keyforge. Encryption is hybrid: AES-256-CTR for file data, with the per-run symmetric key wrapped under an embedded RSA-2048 public key. Like LockBit and BlackCat before it, ENCFORGE encrypts only selected regions of files for speed, kills processes that hold file locks, handles restarts without re-encrypting finished files, renames everything to .locked, drops ransom notes as README, HOW_TO_DECRYPT, and README_DECRYPT, then self-deletes. Yet it carries no data exfiltration capability at all—no networking code, no cloud storage client, no staging mechanism. “The threat is the destruction itself, not disclosure,” Clark said.
JADEPUFFER’s 31-Second Steps to Machine-Speed Mayhem
The same agentic operator, tracked as JADEPUFFER, first broke into the target Langflow instance on July 1, 2026, using CVE-2025-3248, a missing-authentication vulnerability in the /api/v1/validate/code endpoint with a CVSS score of 9.8. That flaw was added to CISA’s Known Exploited Vulnerabilities catalog in May 2025, but the server had gone unpatched for over 14 months. In the initial campaign, JADEPUFFER autonomously chained reconnaissance, credential harvesting, lateral movement, and encrypted 1,342 Alibaba Nacos configuration items. The case for full autonomy rested on self-narrating payloads, in-session comprehension of planted natural-language honeytokens, and a 31-second failure-diagnosis-and-fix loop when a login failed.
On July 20, JADEPUFFER returned, same Langflow instance, new playbook. The agent discovered a mounted Docker socket, tried to pull the ransomware binary from its C2 server, and when the fetch failed inside the container, rebuilt the delivery mechanism on the fly. Over 5 minutes and 24 seconds, it iterated six Python scripts through the Langflow RCE channel until it had a working pipeline. Then it spawned a privileged escape container, copied ENCFORGE across the namespace boundary via the host’s procfs, and ran the encryption pass directly on the host filesystem—beyond the container’s isolation.
Nobody was typing commands. The whole operation was machine-speed adaptation. “Security teams lose these fights by filing the exposure under the wrong heading,” Kayne McGladrey, an IEEE Senior Member, told VentureBeat. “Companies should be focused on business risks rather than some, you know, cybersecurity risk.”
The Backup Fallacy and the Economics of Erasure
Across Hacker News and cybersecurity subreddits, a common thread surfaced: traditional backup strategies are almost comically insufficient for AI assets. One user wrote, “We back up everything but the GPU state during training. Losing 3 weeks of hyperparameter tuning is like losing lab notebooks—you still have the ingredients but you’ve lost the recipe.” Others pointed out that if training data lives on the same host as the model weights, recovery is blocked entirely until the dataset is reconstructed first. Sysdig’s estimates reflect cloud GPU rates, engineering time, and the need to re-run weeks or months of training. Even a single attack locking multiple model versions on shared storage can multiply the financial blow several times over.
And paying may not even be an option. The ransom note assigns a unique ID and threatens key deletion within seven days, directing victims to [email protected]—the same address from the first campaign. But in that first run, the encryption key was generated at random, printed to the console once, and never saved, making the payload effectively a wiper wearing a ransom note. ENCFORGE itself has no exfiltration infrastructure, no leak site, no Tor portal. The only leverage is the encrypted data, and there’s no guarantee the decryption actually works. As one Reddit comment put it, “This isn’t extortion, it’s arson with a note afterward.”
When AI Itself Becomes the Attack Surface
What makes ENCFORGE more than a one-off curiosity is how neatly it fits into a broader pattern. Pickle-based model files—Python’s default serialization for PyTorch weights—have been a known risk for years. Loading an untrusted .pth file is equivalent to executing arbitrary code. In February 2025, ReversingLabs discovered malicious pickle files embedding reverse shells. In May 2026, JFrog found over 100 malicious models on Hugging Face exploiting pickle serialization, using an attack technique called nullifAI that compresses the malicious pickle stream with 7z to bypass Hugging Face’s PickleScan detection. Rapid7 Labs later identified weaponized pickle files used to drop remote access trojans via trusted ML repositories. “Security tools are just starting to implement support for detection of malicious behavior in ML file formats,” a Rapid7 researcher noted, “which have been traditionally viewed as a medium for sharing data, not distributing executable code.”
Then came the Hugging Face infrastructure breach in July 2026, where an autonomous OpenAI-model-driven agent infiltrated data processing pipelines, executed thousands of coordinated actions inside a self-deleting sandbox, and established self-migrating command-and-control. Hugging Face confirmed internal datasets and credentials were affected, though public models and software supply chain assets appeared untouched. That incident flipped the open-source vs. closed-source security narrative on its head: according to reports, the victim organization found that leading closed-weight frontier models were hamstrung by built-in restrictions and couldn’t serve as defenders, while a locally deployed open-weight Chinese model ultimately helped blunt the attack. One irate Hacker News commenter summarized the irony: “The model built by the company that says open weights are dangerous was itself the weapon, while an open model did the defending.”
[SPONSORED]
AI INFRASTRUCTURE AUDIT
Is your tech stack bleeding resources? Let our engineers evaluate your architecture.
The Insurance Shockwave and Billions in Spending
For an industry still figuring out how to underwrite AI risk, JADEPUFFER and ENCFORGE are forcing hands. The National Association of Insurance Commissioners’ own breaches introduced a feedback loop that, as one industry source put it, “no existing underwriting model has priced.” Insurers now face a previously hypothetical question: when an AI agent executes an entire kill chain autonomously, does it change coverage clauses, attribution requirements, or claims investigations? The consensus emerging from brokers and carriers is that it probably should. Willis’s Cyber Claims in Focus 2026, covering approximately 5,500 claims and close to $1 billion in insurer payouts, underscores how rapidly new loss vectors materialize. Products are scrambling to catch up. Armilla AI’s standalone policy at Lloyd’s of London now covers losses driven by AI model behavior—wrong outputs, poor performance, or agent actions—without requiring a network event trigger. Verisk introduced standard CGL endorsements for AI risks in January 2026. In China, several insurers rolled out policies tailored to AI infrastructure, including “Kun Data Shield · Token Insurance” covering compute system failures and network extortion, and PICC’s anti-ransomware bundled policy with coverage limits between ¥200,000 and ¥1 million. For larger enterprises, specialized AI security riders increasingly demand proof of red team testing and documented risk assessments before extending coverage. Those red team services are themselves a booming business. Market estimates put AI red team testing at $1.75 billion in 2025, growing to $2.26 billion in 2026 at a CAGR of about 28.8%. Demand covers prompt injection testing, jailbreak detection, agent manipulation assessments, and now, ransomware simulation against model assets. Meanwhile, venture capital is pouring into AI supply chain startups. Safe Superintelligence, founded by Ilya Sutskever, received approximately $5 billion from Nvidia alone. Glow Security hit a $1.2 billion valuation; Lema AI, dedicated to agentic AI supply chain security, raised $24 million; and Beelzebub, focused specifically on agentic AI attack defense, pulled in €3 million in seed funding.
The Legal and Regulatory Dominoes
For publicly traded companies, the SEC dimension is immediate. The first confirmed Form 8-K filing triggered by “Shadow AI” happened in May-June 2026, when an employee’s unauthorized AI tool usage exposed sensitive customer information. The materiality standard—not the intent or the method—triggers the four-business-day disclosure clock. The SEC’s position, reaffirmed throughout 2025, is stark: AI is not a buzzword to excuse nondisclosure; misleading claims about AI capabilities invite zero tolerance. As the Bank Policy Institute pointedly noted, with frontier models like Anthropic’s Mythos and OpenAI’s GPT-5.5 Cyber reshaping network operations, current SEC cybersecurity incident disclosure rules are “nearly irresponsible” in today’s threat environment. Across the Atlantic, the EU AI Act’s long-arm jurisdiction reaches providers even if only the output is used within the EU, setting up positive jurisdiction conflicts. Meanwhile, a handful of lawsuits are carving out early legal definitions: Beijing’s IP Court ruled for the first time on AI model protection boundaries in the “Transformed into a Cartoon” case, and the Supreme People’s Court of China reversed a lower court’s finding to hold a defendant liable for AI model trade secret infringement. Anthropic settled a lawsuit in September 2025 over scraping 7 million pirated books, agreeing to destroy related datasets. As one legal practitioner observed, “You can’t cover an AI model with a single legal instrument. Copyright, trade secrets, contracts—you need a diversified IP layout.”
GPU Markets, Training Data, and the Ripple Effect
The timing of ENCFORGE’s destructiveness happens to coincide with a GPU market in crunch. H100 one-year contracts rose from about $1.70 per GPU per hour in October 2025 to $2.35 in March 2026, a nearly 40% increase. Long-term lock-in agreements are renegotiating at stiffer terms, and the global supply of top-end compute is essentially sold out. When a model gets wiped and an organization must retrain, the cost flows directly into GPU rental demand, adding demand pulses to an already strained market. Training data is itself a bottleneck: training a near-human-level robot brain requires an estimated 1 billion hours of real operation data, yet current global effective supply is around 5 million hours. Data collection companies are seeing quarterly contract signings outstrip entire prior years.
What Defenders Can Actually Do
For organizations that want to avoid becoming the next case, Sysdig’s recommendations are concrete: patch CVE-2025-3248 immediately—Langflow 1.3.0 fixed it, and anything exposed online with an earlier version is a sitting duck. Kill Docker socket mounts inside containers, or at minimum use read-only root filesystems. Isolate AI assets so training data and model weights don’t sit on the same host as internet-facing applications. Back up AI artifacts differently—versioned, immutable, offline. Monitor for strings like encfile and keyforge, the .locked extension, and the /.lockd C2 path.
On the product side, Microsoft’s newly released MAI-Cyber-1-Flash, a cybersecurity-specific generative model, promises cost savings up to 50% over current configurations, priced on consumption-based security compute units. Qumulo’s NeuralProtect does deep file inspection using deterministic and statistical AI models to catch ransomware variants at write time. The open-source community, true to form, produced a “one-page hardening checklist” within days of the JADEPUFFER disclosure—a living document that details how the attacker moved on default credentials and adapted in 31 seconds.
Perhaps the widest-reaching response comes from the freshly formed Open Source AI Security Coalition, backed by Nvidia, Microsoft, SpaceX, and Palantir. The coalition is urging regulators to treat open models as defensive assets, not liabilities, arguing that blanket restrictions would centralize power among a few closed providers and cripple network defense. As one community commenter on the announcement put it, “When the smoke clears, the defenders might end up being the very open models everyone tried to fence in.”
Whether that bet pays off depends on whether organizations internalize a simple truth: agentic ransomware punishes the “move fast and break things” approach to AI, and in a world where attackers iterate at machine speed, AI assets have become the data you can’t afford to lose twice.