JadePuffer agentic attacks now target AI model data with ransomware

The JadePuffer autonomous AI agent used a tailored ransomware called EncForge to encrypt AI/ML assets—model checkpoints, vector indexes, and training data—after exploiting a Langflow vulnerability and an exposed Docker socket to gain root access; the Go-based binary targets ~180 AI-related file types, uses AES-256 with RSA-2048-wrapped keys, and appends a .locked extension while researchers saw no evidence of data exfiltration.