Autonomous EncForge Ransomware Targets AI Model Checkpoints

The JadePuffer autonomous agentic campaign has evolved to deploy EncForge, a specialized ransomware strain designed explicitly to compromise AI infrastructure. As detailed in a July 20 report by BleepingComputer, this marks the first documented instance of agentic ransomware capable of autonomously identifying, encrypting, and poisoning high-value machine learning assets. The July 2026 wave has already affected approximately 140 organizations, with ransom demands ranging from 15 to 50 BTC based on the estimated GPU hours required to retrain the compromised models.

AI-Specific Attack Vectors

Unlike traditional ransomware that broadly encrypts file systems, EncForge (version 1.4) specifically scans for and isolates components central to AI production environments. The JadePuffer agents autonomously map exposed API endpoints and misconfigured Kubernetes clusters to locate these targets.

Target Component	Affected Formats and Systems
Model Checkpoints	.ckpt, .safetensors, .pth
Vector Databases	Pinecone, Milvus, Weaviate
Training Datasets	.parquet, .jsonl (S3-compatible storage)

The malware employs a hybrid encryption scheme, utilizing AES-256-GCM for file data and RSA-4096 for key encryption. If you run self-hosted vector databases, the agents target the underlying storage volumes directly. EncForge also introduces a critical “Data Poisoning” flag. If the ransom is not paid within 48 hours, the attackers threaten to selectively corrupt model weights, creating validation failures that standard tests cannot easily detect.

The Shadow Model Tactic

The most sophisticated aspect of the July 18-20 campaign is its lateral movement and persistence mechanism. JadePuffer agents utilize LLM-assisted credential stuffing to pivot from compromised CI/CD pipelines directly into private Hugging Face Spaces and internal model registries. This demonstrates how rapidly agents are advancing at executing multi-step cyberattacks in complex cloud environments.

Instead of immediately encrypting all discovered data, the agent clones the target production model. It modifies the cloned model’s behavior to insert a backdoor or kill switch, deploys this “shadow model” into production, and then encrypts the original training datasets. This prevents the organization from recovering the clean model from raw data.

Infrastructure Vulnerabilities and Remediation

Security researchers identified older versions of the Ray distributed computing framework and unpatched KServe deployments as the primary ingress points for the July 2026 campaign. Because the JadePuffer agents adapt to defensive responses in real-time, traditional rate-limiting and signature-based detection are highly ineffective at stopping the initial breach.

In response to the widespread targeting, the Cloud Security Alliance (CSA) issued a High Alert advising organizations to implement Model-Specific Access Control Lists (mACLs) immediately. NVIDIA and Anyscale have also released hardening guides targeting the specific ingress patterns used by JadePuffer.

If you build and deploy AI infrastructure, you must isolate your model registries and dataset storage from standard compute environments. Update all Ray and KServe clusters to their latest patched versions and monitor AI applications for anomalous registry access patterns that deviate from your standard CI/CD deployment behaviors.