File extensions targeted by EncForge: 180+ (Source: Sysdig research, as reported by BleepingComputer (July 20, 2026))
An Attacker That Doesn't Sleep
Security researchers at Sysdig documented an intrusion in July 2026 by JadePuffer, an autonomous AI agent capable of running a ransomware attack end to end — from initial access to encryption — without a human operator directing each step. What made the case notable wasn't the automation. It was the payload. The malware, named EncForge, was not written to encrypt spreadsheets or contracts. It was written to encrypt the infrastructure that AI systems run on.
EncForge, a Go-based binary using AES-256 counter-mode encryption with an RSA-2048-wrapped key, is built to locate and lock Hugging Face SafeTensors files, PyTorch and TensorFlow model weights, GGUF and GGML checkpoints, FAISS vector indexes, LoRA adapters, and training sets stored in Parquet, Arrow, TFRecord and DuckDB formats. For a budget-signer, the distinction matters: these are not IT files with a nightly backup job. They are often the single largest line item in an AI program's cost sheet — the trained artifact itself.
The Ransom Was Unpayable by Design
Independent reporting on the incident noted a detail that changes the risk calculus entirely: JadePuffer generated a ransom demand, but the encryption key was never stored or transmitted. There is no decryption path, even for a paying victim. This makes EncForge functionally destructive rather than extortionate — the only recovery path is pre-existing immutable backups of the encrypted assets. For organizations budgeting AI infrastructure, the question this raises is whether training data, model checkpoints, and vector stores currently carry the same backup and recovery planning as any other production system.
The Entry Point Was a Known, High-Severity Flaw
The case Sysdig documented did not rely on a novel exploit. Initial access came through CVE-2025-3248, a CVSS 9.8 unauthenticated remote code execution vulnerability in Langflow, a visual builder for AI application workflows. CISA added this CVE to its Known Exploited Vulnerabilities catalog in May 2025, confirming active exploitation. Langflow sits outside the set of frameworks WebPulse's detection engine tracks across its 466K+-site scan sample — this is a single documented intrusion, not a scanned population — but the architectural point stands: the entry vector was a web-facing AI tool with a known, previously patched, actively-tracked flaw, not a zero-day.
A Broader Shift, but Keep the Scope Honest
WebPulse's scoring model added an AI-Readiness dimension to its framework benchmarks because the web-facing stack that used to just render pages now also serves vector search, retrieval pipelines, and model endpoints. WebPulse's Common Crawl census detected llms.txt files on 28 sites out of 466K+ scanned — markers of infrastructure built for machine rather than human consumption. These are client-facing crawler directives, not backend ML infrastructure like the vector databases and model stores EncForge targets, so the connection is illustrative rather than direct: both signal that AI-native infrastructure is being built, and EncForge is a preview of what happens once the backend half is common enough to be worth building ransomware for.
One Case, Not Yet a Pattern
Sysdig's report documents a single intrusion — there are no published victim counts, and no data yet on how often EncForge or similar tooling has been deployed elsewhere. What it establishes is narrower and more concrete: a ransomware family purpose-built for AI/ML assets exists, it has been used against at least one target, its entry point was a web-facing AI tool with a documented CVE rather than an unknown weakness, and its ransom structure made payment impossible by design. This is the first documented case, not an established trend.
