Framework
Open-source, low-code visual framework for building AI and LLM-powered workflows and agents, used by developers to prototype generative AI applications.
Attackers made 1,423 attempts against Previdian honeypots since September 19 to exploit Langflow CVE-2026-105740 (CVSS 9.9, versions before 1.9.0). In one sequence they got the required login with a common username and password, Previdian said.
Reality
Sysdig says an LLM-driven operator it calls JADEPUFFER ran a database-extortion campaign on its own, entering through unpatched Langflow flaw CVE-2025-3248. It calls the operation the first documented ransomware run end to end by a model.
Reality
Microsoft says Storm-3168, also tracked as JADEPUFFER, used two stolen Azure service principals to try deleting more than 100 storage accounts. The deletions took about seven minutes, so the 17 hours of API reads before them were when anyone watching those identities had time to act.
Perspective Coverage
6 publishersReality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishersReality
Rapid7 published a Metasploit module for CVE-2026-85706, an unauthenticated file read it says is already exploited against self-hosted GitLab. Every CE and EE build from 18.7 stays exposed until 19.1.8, 19.2.6 or 19.3.2.
Reality
n8n went from $2.5bn to $5.2bn in seven months and SAP is embedding its canvas in Joule Studio, while the single number offered for agent failure, an 88% security incident rate, arrives without a population or a definition.
Reality
Mysterium VPN counted 36,769 self-hosted AI endpoints reachable from the public internet. Ollama is the only population where the scan can prove that nothing on the host asked for credentials.
Reality
One HTTP request runs Python on an exposed Langflow server, and Sysdig's honeypots logged exploit attempts inside a day of the March 17 advisory, before any public proof-of-concept existed. The traffic identified itself as nuclei.
Reality
Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.
Reality
Anil Madhavapeddy patched a path traversal bug in OCaml's cohttp and found probes for it in his logs ten minutes after opening the fix PR. His own agent had already built the exploit from a bug-class hint.
Reality
Root Evidence rebuilt the exploitation clock on vendor advisory dates rather than NVD publication, and Jeremiah Grossman's team reads the resulting four-month median as a measure of inventory that stopped being maintained.
Reality
VulnCheck logged more than 15,000 successful hits on decoy Langflow instances while eleven new flaws joined the exploited-in-the-wild list, on a product whose first deployment model expects to face the internet.
Reality
Rapid7 describes eleven of the sixteen additions, and eight of those are scanners rather than exploits. The unauthenticated file reads and SQL injections carry the real pressure this quarter, well ahead of the two Tenable modules.
Reality
CVE-2026-48519 lets anyone holding a shared Langflow playground link supply their own Python inside the build request. The exposure follows a user clicking share, so it lives in flow state rather than in server config.
Reality
Censys counts more than 294,000 public IPs running one of 43 AI or LLM tools, up from roughly 183,000 in October 2025. The two platforms it names for growth, Langflow and LiteLLM, both carry KEV-listed flaws.
Reality
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
The vendor reports 10-plus CVEs and up to 200,000 exposed instances, and says Anthropic declined to change the protocol, describing the behaviour as expected.
Reality
Tenable says autonomous agents mapped 21 Taiwanese government systems in four days. The way in was discoverable federation configuration and weak credentials, not a novel exploit.
Reality