JadePuffer

You have spent months training an AI model. Thousands of GPU hours. Hundreds of thousands of pounds in compute costs. Your team has fine-tuned it, validated it, and deployed it to production.

Then someone encrypts it. Not your database. Not your files. Your model.

This is what happens when ransomware meets AI infrastructure. And it is already happening.

⚠️ DISCLAIMER

This article is for educational and defensive purposes only.

These malware and attacks are actual and have been seen in the wild. Knowing their working can be extremely useful in fighting back against them. This information is intended for security professionals, researchers, and defenders, not for malicious use.

Do not attempt to replicate, deploy, or test these techniques on any system or device you do not own or have explicit written permission to test. Unauthorized use of these techniques is illegal and unethical. The author and publisher are not responsible for any misuse of the information contained in this article.

If you suspect your AI infrastructure has been compromised, follow the remediation guidance provided or consult a qualified security professional.

What Is JadePuffer

JadePuffer is the first documented case of agentic ransomware, an attack driven end-to-end by an AI agent rather than a human operator. It was discovered by security researchers in July 2026.

JadePuffer made use of a vulnerability present within Langflow, an open-source framework which is used to develop artificial intelligence applications. The rogue agent independently conducted reconnaissance, credentials stealing, lateral movements, and data encryption.

However, JadePuffer didn’t settle at this point. It returned, upgraded, and deployed a purpose-built tool called ENCFORGE.

ENCFORGE: Ransomware Built for AI

ENCFORGE is a compiled ransomware designed specifically to destroy AI infrastructure. It targets approximately 180 file extensions across the modern AI and machine learning stack.

What it encrypts:

• Model checkpoints (.ckpt, .h5, .pb, .onnx)
• PyTorch weights (.pt, .pth)
• Hugging Face SafeTensors (.safetensors)
• Quantized models for local deployment (.gguf, .ggml)
• Vector indexes (.faiss)
• Training datasets (.parquet, .arrow, .tfrecord, .npy)

The targeting is deliberate. This is not a generic file encryptor. It was built for one purpose: destroying the assets that make AI systems valuable.

The Attack Flow

Step 1: Initial Access

The attacker uses the vulnerability in Langflow to execute unauthenticated remote code on the host.

Step 2: Reconnaissance

Credentials are gathered by the AI in the environment. Credentials are extracted by the AI from the LLM Provider API keys, cloud credentials, and database passwords

Step 3: Privilege Escalation

The open docker socket is discovered by the AI in the path /var/run/docker.sock. Having access to this socket results in root access. The process of privilege escalation enables the AI agent to establish a root container in the host PID namespace.

Step 4: Autonomous Adaptation

Following the failure of the first try at downloading ENCFORGE, the malware doesn’t give up. It writes and tests several scripts in Python within minutes until it finds one that functions. Each of the scripts is written for each failure faced in the earlier attempt.

Step 5: Encryption

ENCFORGE uses AES-256-CTR with an RSA-2048 key exchange. Encryption is done on parts of files and not on entire files to enhance speed. Victims are given unique keys. Files that are encrypted receive the extension .locked.

Step 6: Ransom Note

The malware releases a ransom note with an e-mail address where victims have seven days to reach out.

Why This Is Different

Traditional ransomware encrypts files. You restore from backup, pay, or lose the data.

Encryption of an AI model is different. There is no way to restore the model using a backup. This is because the model itself is the end result of many weeks and even months of training and fine-tuning.

The cost:

Recovering a single production AI model can cost hundreds of thousands of dollars in GPU compute and engineering time. If the training data is also encrypted, recovery is blocked entirely until that data is reconstructed first.

No double extortion:

ENCFORGE has no data exfiltration capability. There is no leak site. The threat is not disclosure. It is destruction. The attacker's leverage comes entirely from the time and cost required to rebuild what was destroyed.

How to Protect Yourself

• Patch Langflow immediately. Upgrade to the latest version. The vulnerability that enabled the attack has been patched.
• Remove exposed Docker sockets. Do not mount /var/run/docker.sock in containers that do not need it. Standard Langflow deployments have no need to create containers.
• Langflow should be run without root permissions. The permissions of the process executing Langflow should be limited such that even after code execution, the possible actions of the attacker are limited.
• File permissions should be put in place to secure the directories containing the model weight files, training data, and vector indexes.
• Maintain offline backups. Backups are critical for general data recovery, but for AI models, the gap between the last clean snapshot and the attack represents weeks or months of work. Offline or immutable snapshots of production model artifacts are essential.
• Rotate credentials. AI provider keys, cloud credentials, and database secrets accessible to the Langflow process should be rotated immediately.

The Bottom Line

JadePuffer 2.0 is a warning. Attackers are not just targeting your infrastructure. They are targeting the value you have built on top of it.

The attack was not sophisticated in terms of novel vulnerabilities. It relied on known flaws and misconfigurations. The innovation was in the automation. An AI agent chained together reconnaissance, privilege escalation, credential theft, and encryption at machine speed.

ENCFORGE is not a generic file encryptor. It is a tool specifically designed to destroy the assets that make AI systems valuable: trained models, training data, and vector indexes.

The operator returned to the same vulnerability, upgraded their toolkit, and attacked again. They invested in reusable infrastructure between campaigns.

AI infrastructure is now a target. Treat it like one.

FAQ Section

What is JadePuffer?

JadePuffer is the first documented case of agentic ransomware—an attack driven by an AI agent rather than a human operator. This ransomware attacks AI infrastructure and encrypts machine learning models and training data.

What is ENCFORGE?

ENCFORGE is a purpose-built ransomware designed to destroy AI infrastructure. It exploits more than 180 different file extensions, such as models' weights, datasets used for training, and indexes of vectors.

What is the propagation mode for JadePuffer?

The ransomware exploits a security vulnerability found in the Langflow framework that allows building artificial intelligence applications on an open-source basis. The agent exploits its features for privilege escalation, stealing credentials and deploying ransomware.

Why is AI model encryption different from traditional ransomware?

Traditional ransomware encrypts files that can be restored from backup. AI models are the result of weeks or months of training. Rebuilding them requires rerunning all of that work, which is extremely expensive and time-consuming.

How can I protect myself from JadePuffer?

Ensure that you update Langflow, secure the exposed Docker socket, run Langflow without superuser permissions, backup the data offline, and use new passwords.