On August 28, 2026, VulnCheck published research from its network of deliberately vulnerable internet-facing canary systems showing what actually happens to an exposed Langflow host. Langflow is a popular low-code builder for LLM applications, and it has become one of the most heavily targeted pieces of AI infrastructure on the internet: before 2026 exactly one Langflow vulnerability was known to be exploited in the wild, and by the time of this writeup twelve had been.
The canaries recorded more than 15,000 successful exploitation attempts across CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. Two distinct operators showed up with different playbooks against the same target. The first used CVE-2026-5027, an upload path traversal that yields arbitrary file write and therefore code execution, and spent the following two weeks dropping a Python credential harvester, proxy agents, and a SimpleHelp remote access tool, establishing IRC command and control by June 8, 2026. The second went straight to commodity monetisation, installing an XMR cryptocurrency miner, setting up persistence, and then pivoting to scan for further targets by late June.
The credential harvesting is the part that should worry anyone running an AI stack. The interesting loot on a Langflow box is not the box. It is the environment: the Langflow secret key, administrative credentials, SSH access and shell history, and above all the AWS secrets and OpenAI API keys that an LLM orchestration server necessarily holds in order to do its job. A single unpatched low-code AI builder is a concentrated key ring for the rest of the organisation’s cloud and model spend.
The uncomfortable pattern is that none of this required novel technique. These are ordinary web vulnerabilities in a young, fast-moving open-source project that operators put on the public internet because it was the quickest way to ship an agent. The AI layer did not make the attack clever. It made the payoff bigger, because that is where the keys now live.