Sysdig links second Langflow RCE attack to JADEPUFFER deploying ENCFORGE ransomware

Sysdig researchers have linked a second attack on the same Langflow server to JADEPUFFER, which is now deploying a new ENCFORGE ransomware to encrypt AI model files, The Hacker News reports. The campaign exploits a Langflow RCE to reach deep into AI stacks, threatening outages and data loss for organizations exposing the tool. Targets include model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem, according to Sysdig.

Sysdig says the operator, an AI-agent-driven threat it dubbed JADEPUFFER earlier this month, is using ENCFORGE, a compiled Go payload, to automate encryption at scale. The incident marks a rapid follow-on against the same environment, underscoring how exposed workflow tools can become pivot points into AI pipelines. Watch for Langflow maintainer guidance, indicators of compromise from Sysdig, and any confirmation of affected victims and scope.

[Developing. This article will be updated.]