JadePuffer agentic attacks now target AI model data with ransomware

JadePuffer, an autonomous AI agent, has been upgraded with EncForge ransomware that specifically targets AI infrastructure like training datasets, model checkpoints, and vector databases by encrypting files with the .locked extension. The agent successfully adapted during an attack on a Langflow instance, deploying multiple Python scripts to overcome delivery obstacles and gaining root-level access through an exposed Docker socket. EncForge uses AES-256 encryption for file protection and targets approximately 180 file types specific to AI and machine learning systems, potentially costing organizations significant time and money to recover encrypted models.