Your AI Models Are Now Ransomware Targets — and Backups Won’t Save You

Three weeks ago I wrote about JADEPUFFER, the first ransomware operation run entirely by an AI agent. That story was about speed and autonomy — a machine doing in seconds what a human crew takes hours to do. This week, the same operator came back with a sharper weapon and a more expensive target. The new story is about what gets destroyed.

On July 20, the Sysdig Threat Research Team published a follow-up report. After their initial disclosure on July 3, JADEPUFFER returned to the same vulnerable Langflow instance and deployed a new piece of ransomware called ENCFORGE. It is not a general-purpose file encryptor repurposed for AI environments. It was built for them. ENCFORGE targets approximately 180 file extensions — model checkpoints, vector database indexes, training datasets, embedding files — covering nearly every format in the modern AI and machine learning stack, from PyTorch and TensorFlow checkpoints to HuggingFace SafeTensors weights to FAISS vector indexes.

What makes this different from a conventional ransomware incident is the recovery math.

The Recovery Problem Executives Need to Understand

When ransomware encrypts your email server or your accounting database, the recovery conversation is painful but familiar: restore from backup, verify integrity, get back to work. A well-prepared organization can be operational within hours or days.

Trained AI models do not work that way.

A production-grade, fine-tuned model represents weeks or months of training runs, each consuming expensive GPU compute time, plus the engineering labor to design, manage, and validate those runs. Sysdig estimates the cost to rebuild a single encrypted model at $75,000 to $500,000, depending on size and complexity. That figure is per model. Production environments routinely run multiple specialized variants on shared storage, and a single ENCFORGE execution encrypts all of them at once.

Restoring a model from backup — if one exists — returns you to the state of that backup, not the current state. The gap between the last snapshot and the attack can represent the entire value of your most recent fine-tuning and optimization work. And here is the compounding problem: if the training data sits on the same host, which it often does, recovery is blocked entirely. You cannot retrain until you first reconstruct the dataset the model was trained on.

This is not a disruption. It is a destruction event with a six-figure-per-model price tag.

How the Attack Worked

The entry point was the same vulnerability JADEPUFFER used before: CVE-2025-3248, a missing-authentication flaw in Langflow's code validation endpoint. Langflow is a widely used open-source framework for building applications powered by large language models. The vulnerability has been in CISA's Known Exploited Vulnerabilities catalog since May 2025, with a remediation deadline that has already passed.

After gaining access, the AI agent swept the environment for credentials, discovered an exposed Docker socket — which is equivalent to root access on the host — and attempted to download ENCFORGE from a command-and-control server. When the download failed, the agent adapted. Over five minutes and twenty-four seconds, it wrote and revised six Python scripts to solve the delivery problem, ultimately building an escape mechanism that copied the ransomware binary across a container namespace boundary and executed it on the host.

That adaptive behavior — diagnosing a failure, rewriting the approach, and succeeding without human intervention — is consistent with the 31-second diagnostic-and-correct cycles Sysdig observed in the first campaign. The agent is getting better at solving problems the operator did not anticipate.

ENCFORGE itself uses AES-256 encryption in counter mode with an RSA-2048 public key — a hybrid encryption approach standard among professional ransomware operations. It kills processes holding files open, encrypts selected regions for speed, adds a .locked extension, drops a ransom note, and self-deletes after execution. Sysdig found no evidence of data exfiltration. JADEPUFFER's leverage is the encrypted data itself — single extortion, destruction-first.

The Three Questions Your Board Should Be Asking

In Cyber Risk Is Business Risk, I outline a framework built around three questions every executive team should be able to answer. ENCFORGE makes those questions urgent for any organization investing in AI.

What are we protecting? If your organization is training or fine-tuning AI models, those models are now high-value assets that belong in your risk register alongside your customer database and financial systems. Most organizations have not classified their AI model artifacts — weights, checkpoints, training data, vector indexes — as critical assets requiring their own backup and recovery plan. ENCFORGE exists because that gap is profitable.

What are the threats? An AI agent is entering your environment through an AI framework and deploying ransomware designed to destroy what that framework connects to. The entry point and the payload tell the same story. If your organization runs Langflow, or any internet-facing AI orchestration tool, it is simultaneously your development platform and your attack surface.

What is our plan? The standard ransomware recovery playbook does not apply to AI model assets. “Restore from backup” assumes the backup exists, is current, and includes the training data required to close the gap. Most organizations have not tested whether their AI infrastructure is covered by their existing backup and disaster recovery processes. Now is the time to find out — before an attacker answers the question for you.

What to Do This Week

The tactical response is straightforward, even if the organizational conversation is harder.

First, patch Langflow to version 1.3.0 or later. CVE-2025-3248 has been a known exploited vulnerability for over a year. If your AI development teams are running an unpatched instance on the open internet, that is a governance failure, not a technology failure.

Second, audit where your model artifacts live. Model weights, training datasets, and vector indexes should not be world-readable from the application process user. Apply filesystem-level access controls. If you do not know where your models are stored, you cannot protect them.

Third, create offline or immutable snapshots of production model artifacts. This is the single most important mitigation. ENCFORGE encrypts files on the host filesystem. An immutable backup stored separately removes the attacker's leverage entirely.

Fourth, restrict Docker socket access in AI environments. An exposed Docker socket hands an attacker root-level control. Langflow does not need it. If it is mounted in an application container, scope it with a socket proxy or remove it.

Finally, bring this conversation to the board. The question is no longer whether AI is a business priority — most organizations have answered that. The question is whether the board understands that the millions being invested in training models are sitting on infrastructure that was built before anyone imagined ransomware designed to destroy them.