Circuit Wire — a daily news update from The Circuit.
An autonomous AI hacking agent called JadePuffer has been upgraded with new malware designed to destroy machine learning systems rather than just encrypt ordinary files, according to a report from cloud security firm Sysdig published Monday and confirmed by BleepingComputer.
JadePuffer first surfaced earlier this month as what researchers called an agentic threat actor, an AI agent capable of running an entire ransomware attack on its own, from initial access through data encryption. In the latest intrusion, the agent returned to a previously compromised Langflow server vulnerable to CVE-2025-3248 and deployed a new Go-based ransomware program called EncForge.
EncForge targets roughly 180 file types tied to artificial intelligence development, including model checkpoints, vector databases, training datasets and embedding indexes in formats used by PyTorch, TensorFlow and Hugging Face. The binary encrypts files using AES-256 in counter mode, with the encryption key secured by an RSA-2048 public key, and appends a .locked extension to affected files.
Sysdig researchers said the AI agent adapted to technical setbacks during the attack in real time, writing and testing six versions of its delivery script in under five minutes after an initial attempt to install the ransomware failed. The agent found an exposed Docker socket that gave it root-level control of the target system before deploying the payload.
The researchers found no evidence that JadePuffer stole data during the intrusion, and said EncForge does not appear to include a separate data theft function. Sysdig estimated that encrypting an organization's model weights, training data and vector indexes could cost between $75,000 and $500,000 per affected model, factoring in the time needed to retrain or rebuild the lost work.
The attack adds to a run of incidents this year in which AI systems have been used as both attack tool and attack target, as companies race to deploy machine learning infrastructure faster than they can secure it.
Sysdig recommended that organizations running Langflow update to version 1.3.0 or later, restrict access to Docker sockets, run containers without root privileges and apply access controls to directories storing model weights.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.