Sysdig disclosed ENCFORGE later in July: the same operator, identified through a matching extortion contact address, returned to the previously compromised Langflow instance and staged a compiled Go ransomware binary purpose-built for AI infrastructure.
Where the original campaign relied on improvised Python scripts and a database’s own encryption function, ENCFORGE targets roughly 180 file extensions across the AI/ML stack, including model checkpoints, vector databases, training data, and embedding indices.
The operator escalated through an exposed Docker socket to reach root-level host access, then iterated through successive delivery scripts over roughly five minutes to work around failures before the payload landed.
The recovery problem is different from a conventional database attack. Production models, training data, and embedding assets may not have the same backup and recovery coverage as conventional business data.
Sysdig estimates that rebuilding a single affected model can cost $75,000 to $500,000 in compute and engineering time.
The more significant escalation is the one Unit 42 documented independently, in a different environment with a different operator. Unit 42 describes a human attacker who set objectives and then left tactical execution to AI agents that monitored, evaluated, acted, and re-planned in real time.
On September 2, researchers Renzon Cruz, Nicolas Bareil, Eric Semaan, and Omar Jbari published an account of an intrusion that began with a breach of a public-facing API and, ten hours later, had reached across the victim’s cloud, identity, CI/CD, and AI infrastructure.
Rather than one agent working sequentially, specialized agents worked in parallel: one mapped internal microservices, others combed source repositories for hard-coded tokens and service passwords, another used the harvested credentials to reach the secrets manager and pull root-level administrative credentials, and a pipeline-focused agent triggered unauthorized CI/CD builds and obtained cloud access keys, which it then used against the victim’s AI infrastructure.
The agents then used those stolen keys to route their own orchestration traffic through the victim’s own AI endpoints, which made it harder to distinguish from ordinary model usage.
One persistence attempt, a backdoor planted in Terraform configuration, failed because branch-protection controls required a second human reviewer before the change could merge.
The attacker told Unit 42 during negotiations that they had used frontier AI models and purpose-built agentic attack frameworks.
Unit 42 found independent technical indicators consistent with that claim: parallel calls to multiple frontier models, structured Markdown files passing state between agent sessions, and the same kind of self-narrating, heavily commented code Sysdig had flagged in JADEPUFFER’s payloads.
