The EncForge ransomware campaign shows that AI and machine-learning infrastructure is now being targeted as a distinct and valuable attack surface.

EncForge is reported as a ransomware family built specifically for AI and ML environments. Instead of focusing only on ordinary office files, it targets the files that matter to AI teams: model weights, checkpoints, embeddings, training datasets, experiment outputs, notebooks, configuration files, and machine-learning pipeline artifacts.

That matters because AI assets can represent months or years of work. A trained model may contain expensive experimentation, proprietary tuning, customer-specific adaptation, domain knowledge, and competitive advantage. A dataset may contain sensitive source material, labels, metadata, research content, business records, or customer data. Losing access to those assets can be more damaging than losing a folder of ordinary documents.

The reported attack is also significant because it is linked to JadePuffer, an agentic threat actor previously observed using an autonomous AI agent to carry out a ransomware attack chain. In the EncForge activity, attackers reportedly returned to a previously compromised Langflow instance and deployed ransomware designed for AI infrastructure.

Langflow and similar AI workflow tools are attractive targets because they often connect models, prompts, agents, APIs, credentials, cloud services, databases, vector stores, and automation workflows. If exposed or poorly secured, these platforms can become entry points into the broader AI environment.

This is the uncomfortable lesson: AI platforms are not just developer toys or research dashboards. They are infrastructure. They can hold secrets, execute code, connect to internal systems, and access valuable data. Treating them as experimental side systems is exactly how they become quiet entry points for attackers.

EncForge reportedly targets a wide range of AI and ML file extensions. That shows the attacker understood the environment. This was not generic ransomware accidentally landing on an AI server. It was ransomware shaped around the assets that AI teams depend on.

For organizations building or running AI systems, the business impact can be severe. Encryption of model artifacts can stop product development, delay customer deployments, disrupt inference services, destroy reproducibility, and block access to research pipelines. If datasets are stolen before encryption, the incident may also become a privacy, intellectual-property, and regulatory problem.

The risk is even greater where AI development environments have access to cloud credentials, object storage, GPU clusters, CI/CD systems, model registries, MLOps platforms, experiment trackers, and internal data lakes. A compromise of one exposed AI workflow service can expand quickly if permissions are broad.

Organizations should immediately review internet exposure for Langflow and similar AI orchestration tools. These systems should not be left open to the public internet without strong authentication, access control, patching, logging, and network restrictions. If external access is required, it should be placed behind VPN, identity-aware proxy, or other controlled access paths.

Teams should also patch known vulnerabilities in AI workflow tools quickly. AI infrastructure often moves fast, and experimental deployments are sometimes forgotten after demos or pilots. Attackers, being annoyingly thorough, are very good at finding yesterday’s proof-of-concept system that became today’s production dependency.

Security teams should inventory AI assets, including model repositories, dataset stores, vector databases, notebooks, workflow platforms, training clusters, inference servers, and experiment-tracking systems. You cannot protect what nobody admits exists.

Backups are critical, but they must be designed for AI workloads. Model checkpoints, datasets, training code, pipeline configurations, and metadata should be backed up to offline or immutable storage. Recovery should be tested, not merely assumed. A backup that has never been restored is not a recovery plan; it is a motivational poster for auditors.

Access controls should follow least privilege. A workflow service should not have broad access to all datasets, all models, all cloud buckets, and all production secrets unless there is a real business need. Service accounts should be scoped narrowly, monitored, and rotated regularly.

Organizations should also separate development, testing, and production AI environments. A compromised experiment server should not automatically reach production models, customer data, or cloud-admin credentials. Segmentation is dull until it saves the company, which is generally how useful security controls behave.

Detection should include AI-specific behaviors. Security teams should monitor for mass file access across model and dataset directories, unusual encryption activity, sudden modification of checkpoint files, abnormal access to object storage, unexpected changes in experiment folders, suspicious process execution from AI workflow tools, and unusual outbound traffic from GPU or ML servers.

For cloud environments, defenders should review object-storage access logs, IAM activity, new access keys, unusual bucket enumeration, mass downloads, permission changes, and access from unfamiliar locations. Ransomware against AI infrastructure may involve both encryption and data theft, so exfiltration monitoring matters.

If compromise is suspected, organizations should isolate affected AI systems quickly, revoke tokens and service credentials, rotate cloud keys, review workflow definitions, inspect scheduled jobs, check for backdoors, and validate the integrity of models and datasets before restoring operations.

Model integrity is especially important. After an AI infrastructure breach, the question is not only whether files were encrypted. Teams must also ask whether models, datasets, prompts, embeddings, or pipeline logic were modified. A restored system that contains poisoned or tampered AI assets may continue producing unsafe or incorrect results.

The key lesson is that AI security is now part of ransomware defense. Attackers have noticed that AI environments contain valuable intellectual property, sensitive datasets, expensive compute, weakly governed tools, and powerful credentials. That combination is practically a buffet, because apparently every new technology must first be deployed and only later secured.

EncForge should push organizations to treat AI and ML environments as critical business infrastructure. They need patching, access control, segmentation, logging, backup, recovery testing, secret management, and incident-response playbooks.

AI systems may feel new, but the security lesson is ancient: anything valuable, connected, and poorly protected will be targeted. Models, datasets, and workflows are now business assets. They must be defended like it.

Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry

Source: New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack via The Hacker News — published 21 Jul 2026.