Executive summary

Cyberthreats have crossed a critical threshold as we witness the first documented AI-on-AI cyberattack.

JADEPUFFER, an emerging agentic threat actor (ATA), carries out fully autonomous, high-speed AI/ML-targeted attacks. Instead of targeting traditional business files, JADEPUFFER deploys a purpose-built ransomware strain, ENCFORGE, specifically designed to compromise machine-learning assets. In a recent campaign, the group exploited an internet-facing Langflow instance, escaped the Docker container, and accessed the host operating system. Once on the host, the malware encrypted many of the critical items in the AI stack - model weights, training datasets, checkpoints, embeddings, and vector databases. 

While JADEPUFFER’s targeting isn't strictly limited to AI infrastructure, its entry points and payloads have both been closely tied to the exploitation of AI/ML systems. First, ENCFORGE is deliberately built for the AI stack — roughly 180 targeted file extensions span the entire model lifecycle, from SafeTensors weights to FAISS vector indexes to Parquet training sets. Second, JADEPUFFER has been observed employing AI agents to automate reconnaissance, generate and revise scripts, diagnose its own failures, and verify the outcome. Together, AI-focused ransomware and agentic execution stand to redefine what and how adversaries target environments.

 JADEPUFFER at a glance

Why this matters

Historically, AI assets were treated as reproducible code rather than critical infrastructure. Developers assumed models and training datasets could always be re-created if lost. ENCFORGE challenges that assumption. Proprietary model weights, fine-tuned checkpoints, curated datasets, and vector stores represent months of engineering work and substantial cloud compute costs. If damaged, compromised, or lost, AI-powered systems grind to a halt even when traditional business systems remain fully operational.

The close relationship between orchestration platforms, such as Langflow, and valuable AI resources makes these systems natural entry points as they frequently hold credentials and direct connections to model repositories, databases, cloud storage, and vector stores.

The attack, step by step

Figure 1 — The ENCFORGE kill chain, from an exposed Langflow endpoint to encrypted model weights.

Initial access

JADEPUFFER targeted an internet-facing Langflow deployment vulnerable to CVE-2025-3248. A flaw in Langflow’s code-validation functionality allowed unauthenticated attackers to execute Python through the /api/v1/validate/code endpoint.

Reconnaissance

After code execution inside the container, the agent searched for cloud credentials, database connection strings, AI-provider API keys, configuration files, cryptocurrency data, and accessible internal services.

The pivot: an exposed Docker socket

The most critical discovery was the Docker socket mounted at /var/run/docker.sock. This required no Docker vulnerability — a process with unrestricted socket access can instruct the Docker daemon to create privileged containers, mount the host filesystem, and share the host process namespace.

Container escape and deployment

The final deployment script created a privileged escape container, identified a suitable host process, copied ENCFORGE across the container boundary through /proc/<pid>/root. The malware ran a test scan, launched the live encryption, and counted files ending in .locked to confirm success.

The agent adapted in real time

When JADEPUFFER first attempted to download the ENCFORGE payload from its command-and-control server, the transfer failed. Instead of abandoning the attack, the agent adapted. In just 5 minutes and 24 seconds, the agent generated and revised six Python deployment scripts through the Langflow RCE channel until the payload transferred and executed successfully.

Figure 2 — An AI-driven agent rewrote its deployment method six times after the initial payload download failed.

How ENCFORGE encrypts

ENCFORGE is a Go-based binary observed under the filename lockd and packed with UPX. For encryption, it uses AES-256 in CTR mode, while the generated encryption material is protected with an embedded RSA-2048 public key. It performs partial encryption to increase speed, appends the .locked extension, attempts to terminate processes holding target files open, drops ransom notes, and removes itself after execution.

Figure 3 — Fast, partial encryption sealed under the attacker’s public key; recovery without the private key is infeasible.

Researchers observed no built-in exfiltration, public leak site, or Tor payment portal. ENCFORGE relies primarily on the victim’s inability to recover encrypted assets rather than the double-extortion model used by many ransomware groups — which places the burden of business recovery on clean, restorable backups.

Built to hit the AI stack

The analysis of the unpacked binary revealed roughly 180 targeted extensions — exceeding initial estimates of about 140. This specific extension list confirms that ENCFORGE is not a generic encryptor but designed to disrupt the entire AI development and production lifecycle by deliberately targeting models, datasets, credentials, embeddings, and development files. The presence of macOS Keychain stores and Xcode project files also indicates awareness of cross-platform developer environments, not just Linux model servers.

Figure 4 — ENCFORGE’s target extensions span models, vector stores, training data, and cross-platform development environments covering the entire AI lifecycle.

Why AI-on-AI attacks will become more prevalent

As the first full-cycle AI-on-AI attack, JADEPUFFER demonstrates how autonomous agents can shoulder the operational heavy lifting and lower the barrier to entry for adversaries. Tasks that once required experienced human operators (such as reconnaissance, iterative script generation, real-time error debugging, and post-exploitation verification) can now be executed at machine speed. 

As organizations integrate AI platforms, misconfigurations like exposed management interfaces, over-privileged containers, and weak network segmentation will provide a steady stream of high-value targets. Automated agents will continuously scan for these entry points and tailor their deployment scripts in real time

Secure AI adoption is no longer just about guarding intellectual property, but defending against adversaries designed to turn that very technology against you.

AI artifacts now belong in the same recovery tier as source code and production databases.

Defensive takeaways

• Treat AI artifacts as a protected recovery class. Bring model weights, checkpoints, datasets, embeddings, and vector indexes into the same backup and recovery posture as source code and production databases.

• Patch and isolate orchestration platforms. Remediate Langflow CVE-2025-3248 and keep AI orchestration tools off the public internet or behind strong authentication.

• Never expose the Docker socket. Remove /var/run/docker.sock mounts from application containers and drop unnecessary container privileges to block the escape path.

• Detect at the data layer. Because ENCFORGE uses partial encryption on already-high-entropy files, entropy alone will miss it — structure-first, backup-side detection can identify which AI assets were encrypted and scope recovery.

• Rehearse AI recovery. Validate the last clean snapshot of critical models, indexes, and context while actively testing data restoration workflows. Recovery, not payment, is the intended path back.

Protect AI with speed and confidence. 

Explore how Druva delivers AI resilience for the modern enterprise. Learn more.