Compromise an internet-facing Langflow instance by exploiting a known vulnerability (CVE-2025-3248) in the popular open-source framework for building AI agents and workflows
\nPivot to an internet-exposed production server
\nEncrypted and destroyed a MySQL database and an Alibaba Nacos configuration service. (Exfiltration of the data has not been verified.)<\/p>\n
Sysdig\u2019s assessment that the attack was LLM-driven rests on several elements, including the natural-language commentary in the payloads that is typical of LLM-generated code, and the extreme speed at which the agent diagnosed and corrected its own failures.<\/p>\n
\u201cThe targeted downstream attack leaned on years-old issues, a 2021 Nacos auth-bypass and an unchanged default signing key, against neglected, internet-exposed infrastructure,\u201d the researchers shared, and noted that \u201cagents make spraying the entire historical vulnerability catalogue effectively free, so the long tail of unpatched systems becomes more exposed, not less.\u201d<\/p>\n
Enter ENCFORGE<\/p>\n
On Monday, Michael Clark, director of threat research at Sysdig, shared a new development: the threat actor has returned to the previously targeted Langflow instance and deployed ENCFORGE, a Go-based ransomware that \u201ctargets approximately 180 file extensions, with a deliberately broad sweep of the modern AI\/ML stack, including model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format.\u201d<\/p>\n
The researchers observed the attacker (i.e., the AI agent) extracting cloud provider keys, database connection strings, and API tokens and reusing\/replaying them to access internal database and cache services.<\/p>\n
Then, it attempted to fetch the ransomware and deploy it. It succeeded on the second attempt, after quickly devising another approach when the first one failed.<\/p>\n
\u201cThe combination of Langflow as an entry vector and ENCFORGE as a payload is no coincidence. Langflow deployments sit adjacent to the infrastructure ENCFORGE is designed to destroy: Model weights, vector stores, and training pipelines are exactly what an AI orchestration framework is built to interact with,\u201d Clark explained<\/a>.<\/p>\n \u201cFor organizations building or operating AI infrastructure, the threat model has expanded. Encrypted business files can be restored from backups, but encrypted production models often cannot. Not only can the ransom cost you millions of dollars, but rebuilding and retraining your models can cost $75,000 to $500,000 each.\u201d<\/p>\n Clark\u2019s advice to defenders is to shrink the attack surface by patching known flaws in internet-exposed infrastructure, and harden the container environment by restricting Docker socket access and running Langflow containers as non-root and setting the noexec (\u201cno execution\u201d) flag on any directory the Langflow process is allowed to write into.<\/p>\n He also advises locking down internet-facing AI orchestration tools, maintaining offline snapshots of production model artifacts, not storing AI provider API keys in Langflow\u2019s runtime environment, and retiring default and potentially compromised credentials.<\/p>\n And, as Sysdig researchers previously noted, the fact that the LLM narrates its own intentions in its payloads can be used by defenders for detection and triage.<\/p>\n![](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/devider.webp\"\/)
<\/p>\n