How CVE-2025-3248 gives attackers initial access to Langflow servers

Langflow, an open-source platform used to build and orchestrate AI agent workflows, has become the entry point for a new ransomware campaign. According to research from Sysdig, attackers are exploiting CVE-2025-3248, a flaw in Langflow that allows them to reach exposed instances and execute code without needing valid credentials first. That initial foothold is the same one a threat group Sysdig tracks as JadePuffer used in an earlier operation, but the payload delivered through it has changed dramatically.

What makes this campaign notable isn't just the vulnerability itself. It's that a flaw in an AI development tool is now a proven, repeatable path into an organization's infrastructure, and attackers are treating it as a launchpad for increasingly serious follow-on attacks rather than a one-off smash-and-grab.

From JadePuffer scripts to compiled Encforge ransomware: how the attack evolved

Sysdig's earlier look at JadePuffer's activity found a relatively unsophisticated approach: improvised scripts paired with native database encryption functions to lock up data after breaking in. It worked, but it was crude compared to what dedicated ransomware crews typically deploy.

The latest wave shows a clear step up. Instead of relying on scripts stitched together on the fly, the attacker now stages a compiled ransomware binary called Encforge once they've gained access through the Langflow flaw. This binary is built to traverse the filesystem methodically and go after machine-learning assets specifically, rather than encrypting generic files and hoping something valuable gets caught in the process.

Sysdig connected the newer Encforge activity back to the earlier JadePuffer campaign through a detail in the ransom note: a contact address that was reused across both operations. That overlap suggests the same group, or at least the same infrastructure and tooling lineage, is refining its approach over time rather than starting from scratch. The shift from improvised scripts to a purpose-built binary is a meaningful maturity jump, and it signals the group expects to keep using this access method going forward.

Why AI and ML workloads are becoming ransomware targets

There's a reason attackers are now building tools that specifically target machine-learning assets instead of just encrypting whatever files happen to be on disk. AI infrastructure often holds things that are expensive and slow to reproduce: trained models, pipeline configurations, datasets, and the orchestration logic that ties them together. Losing access to that, or having it exposed and threatened with an extortion message, can be just as disruptive to an organization as losing customer databases or financial records.

Self-hosted AI platforms like Langflow are also frequently deployed quickly, sometimes by teams more focused on getting a workflow running than on locking down network exposure. That combination, valuable data plus rushed deployment, is exactly the profile ransomware operators look for. This campaign is a concrete example of a broader trend Sysdig has been documenting: AI systems aren't just useful tools for defenders and attackers alike, they're becoming targets in their own right. The same research team's coverage of a fully autonomous AI ransomware attack shows the other side of this shift, where AI agents are being used to run entire intrusions with little human direction. Together, these findings point to AI infrastructure sitting at both ends of the ransomware equation now, as target and as tool.

Practical steps for securing self-hosted AI tools and cloud workloads

Organizations running Langflow or similar AI orchestration platforms should treat them with the same security discipline as any internet-facing server, not as an experimental sandbox. That means applying the patch for CVE-2025-3248 as soon as possible, and auditing whether any Langflow instances are reachable from the public internet without a clear business reason.

Beyond patching, segment AI workloads away from broader production networks so a compromised instance can't easily pivot to other systems. Maintain offline or immutable backups of trained models and pipeline configurations specifically, since those are now demonstrated ransomware targets. Monitor for unusual filesystem traversal activity and unexpected binaries appearing on servers hosting AI tools, since that's precisely the behavior Sysdig observed with Encforge.

What This Means For You

If your organization has deployed Langflow, or any similar self-hosted AI development platform, this campaign is a direct signal to check your exposure now rather than after an incident. The Langflow ransomware CVE exploit chain observed here didn't require advanced techniques to reach victims, just an unpatched, internet-facing instance. For security teams, the lesson is that AI tooling needs to be inventoried, patched, and monitored with the same rigor as any other critical infrastructure, not treated as a lower-priority experimental system.

Actionable Takeaways

  • Patch any Langflow deployment against CVE-2025-3248 immediately and verify the fix is applied across all instances, including test or staging environments.
  • Audit which AI and ML platforms are exposed to the public internet, and restrict access wherever possible.
  • Back up trained models, pipeline configurations, and datasets separately from general file backups, since these are now specific ransomware targets.
  • Watch for signs of compiled binaries or unusual filesystem activity on servers hosting AI workflows, which may indicate a compromise in progress.

The rise of ransomware built specifically to hit AI assets shows that these platforms are no longer a niche corner of the network. Treat them like the critical infrastructure they've become.