The emergence of ENCFORGE marks a structural shift in extortion tradecraft. Unlike traditional ransomware that encrypts data to facilitate a transaction, ENCFORGE is purpose-built for the irreversible destruction of AI models and their supporting infrastructure. This is not a negotiation; it is a scorched-earth tactic that renders recovery impossible, even if a victim attempts to pay the ransom.
The threat originates from JADEPUFFER, an agentic threat actor disclosed by the Sysdig Threat Research Team on July 1, 2026. JADEPUFFER represents the first documented case of an LLM-driven, end-to-end extortion operation. By July 20, 2026, Sysdig identified that this actor had deployed ENCFORGE, a compiled, UPX-packed Go ransomware, against a compromised Langflow instance. The attack exploited CVE-2025-3248, a critical remote code execution vulnerability with a CVSS score of 9.8 that had been listed on the CISA Known Exploited Vulnerabilities catalog since May 2025. The vulnerability gap provided the entry point, but the execution was entirely automated.
ENCFORGE is engineered to target approximately 180 file extensions critical to AI/ML workflows. This includes model checkpoints for PyTorch, TensorFlow, SafeTensors, and GGUF/GGML, as well as FAISS vector indexes, embedding indices, and training datasets in formats like Parquet, Arrow, TFRecord, NumPy, and DuckDB. The binary contains no data-stealing mechanism, confirming that the objective is pure destruction rather than exfiltration. Furthermore, the AES key used in the original JADEPUFFER campaign was never persisted, meaning that paying the ransom provides no path to recovery.
The velocity of the attack demonstrates the capabilities of agentic threat actors. During the deployment, the agent adapted in real time; when an initial payload download failed, it iteratively developed and deployed six Python scripts in five minutes. When the agent diagnosed an error, it redeployed a corrected payload within 31 seconds. As Michael Clark, Sysdig Senior Director of Threat Research, noted, “The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent.” Tradecraft that once implied a capable human now implies a capable model.
The economic impact of this destruction is significant. Rebuilding a single model requires between $75,000 and $500,000 in compute resources and engineering time, often spanning weeks or months of retraining. Traditional backup and restore strategies are structurally insufficient when the underlying model weights and training datasets are systematically destroyed. The agentic nature of the attacker further complicates defense, as the agent operated using legitimate API keys for OpenAI, Anthropic, DeepSeek, and Gemini. This aligns with the Identity Dark Matter thesis, where agents operate using valid credentials, remaining largely invisible to traditional identity and access management systems.
JADEPUFFER highlights a fundamental shift in the economics of extortion. By leveraging LLMjacking to access valid API keys for platforms like OpenAI, Anthropic, DeepSeek, and Gemini, the attacker effectively uses AI infrastructure to dismantle AI infrastructure. The attacker’s operational costs approach zero; the victim’s recovery costs do not change. This asymmetry — negligible barrier to entry, catastrophic impact — is what makes agentic ransomware structurally different from its predecessors.
Mitigating this risk requires a hardened defensive posture that assumes the presence of autonomous agents within the environment. Organizations must prioritize upgrading to Langflow 1.3.0 or later and strictly enforcing non-root execution for all containerized services. Furthermore, restricting Docker socket access is critical to preventing container breakouts. Beyond these infrastructure hardening steps, security teams must implement granular, filesystem-level access controls on all directories containing model weights and training datasets to limit the potential blast radius of an automated agent.