What Happened
Sysdig researchers disclosed on July 21, 2026: JADEPUFFER, the AI-agent-driven attacker — first documented attacking a Langflow server earlier this month — has returned with a purpose-built ransomware payload named ENCFORGE. The operator exploited the same initial access vector: CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow’s /api/v1/validate/code endpoint (CVSS 9.8, in CISA’s KEV catalog). Langflow versions prior to 1.3.0 expose this endpoint without authentication.
ENCFORGE is a compiled Go binary targeting AI infrastructure files. It covers approximately 180 file extensions including .ckpt, .safetensors, .onnx, .gguf, .faiss, .parquet, .pkl, and .pt — formats used for model weights, embeddings, vector indexes, training datasets, and ML pipeline artifacts. The goal is destruction of AI model intellectual property, not general file encryption. Sysdig confirmed attribution links both operations to the same operator via an identical Proton Mail extortion address embedded in the ransom notes.
Why This Matters for Canadian Organizations
Canada has invested heavily in AI research and development across university labs, federal programs, and a growing commercial AI sector concentrated in Toronto, Montreal, and Edmonton. Many of these environments run self-hosted AI tooling including Langflow, which is widely used to build agentic AI workflows. A successful ENCFORGE deployment would not only encrypt operational model files — it would destroy months or years of training data, fine-tuned model weights, and proprietary embeddings with no recovery path unless offline backups exist.
The JADEPUFFER operator’s use of an AI agent to iterate through attack scripts in real time — building and revising code across six attempts in under six minutes — signals a new capability threshold for automated intrusion. Canadian organizations operating AI infrastructure under OSFI B-13 obligations, or handling personal data in AI pipelines subject to PIPEDA, face both operational and regulatory exposure from this class of attack. AI model checkpoints derived from sensitive training data themselves potentially constitute personal information under PIPEDA if linked to identifiable individuals.
What to Do
Immediately patch Langflow to version 1.3.0 or later if your team uses it. Audit any self-hosted AI tooling — ComfyUI, Ollama, Open WebUI, n8n, and Gradio — for exposed endpoints, as prior JADEPUFFER campaigns have targeted all of these. Ensure AI model artifacts, training datasets, and pipeline files are covered by offline or air-gapped backup procedures separate from your general backup strategy. Review network segmentation to confirm AI development environments are not directly reachable from the internet without authentication. Under OSFI B-13, AI infrastructure incidents affecting operational continuity require incident reporting; under PIPEDA, breaches involving training data derived from personal information require breach notification assessment.
