Your AI Agent Builder Is the Attack Surface Nobody Approved

On August 4, CISA added a tool called Langflow to its Known Exploited Vulnerabilities catalog. If you don't run a security team, you've probably never heard of it. If you do run one, I'd bet money someone in your organization has it installed anyway.

Langflow is a low-code platform for building AI agents — the kind of tool a data science team or a product group picks up on a Tuesday afternoon to prototype a chatbot or an automation workflow, no procurement process required. IBM acquired it in 2025 through its purchase of DataStax. It's popular precisely because it's fast and frictionless. That's also why it's dangerous.

The Two-Click Takeover

The flaw, CVE-2026-9198, carries a CVSS score of 9.8 out of 10 — about as bad as vulnerability scoring gets. An attacker needs no credentials and no user to click anything. They chain two API calls: one that hands out a full-admin session token to any caller who asks for it, and a second that runs whatever Python code they submit next. Two requests, full control of the server. IBM shipped a fix in July. CISA's deadline for federal agencies to patch is August 7.

Here's the part that should bother a board more than the CVSS score: this isn't Langflow's first appearance on a bad-news list this year. Security researchers have tracked the platform being hit by cryptomining campaigns in June, a separate remote-code-execution flaw exploited by an AI agent in July, and ransomware built specifically to target AI infrastructure the same month. A tool that keeps getting popped isn't unlucky. It's a pattern, and patterns are what risk committees exist to catch.

The Attacker Was Also Running an AI Agent

The stranger half of this story broke a week earlier. On July 30, Palo Alto Networks' Unit 42 published research on a Chinese-speaking threat actor, tracked under the aliases "knaithe" and "KnYuan," who built an autonomous attack pipeline around the DeepSeek model, orchestrated through an open-source framework called Hermes Agent. Unit 42 got visibility into the operation because the attacker's own automation accidentally exposed a file server, letting researchers read the instructions the operator had been feeding the AI.

When the agent's first attempt against a Langflow flaw failed — the target's configuration blocked it — it didn't stop. It researched other known vulnerabilities on its own and pivoted to higher-value targets without a human telling it where to look next. Unit 42 also found signs the operator used Claude Code for connectivity testing and possibly Codex and Qwen Code elsewhere in the campaign. In total, the actor attempted to breach more than 460 targets through a mix of autonomous and manual technique. Unit 42 could only confirm three were actually compromised.

That last number matters. Andy Piazza, Unit 42's senior director of threat research, put it plainly to IT Brew: "Overall, they weren't very successful. They got some basic memory leak… it's not the big, damning silver bullet that everybody's looking for right now." I'd read that as reassurance with an expiration date. This is a dress rehearsal, not the main event, and Piazza's other point is the one worth sitting with: most companies don't understand how much AI tooling they've already deployed. "The technology sprawl is actually pretty broad," he said, "and I don't think that enterprises quite understand that."

Where This Meets the Book

I wrote about this exact gap in Cyber Risk Is Business Risk: the first of the Three Questions I ask every board is whether they actually know what's running in their environment. Langflow is the answer nobody likes. It didn't arrive through IT procurement. It arrived because someone on a business team needed to move fast, and nobody assigned a sheriff to patrol the tools that showed up afterward.

Shadow AI is shadow IT with better marketing. Most asset inventories still don't have a line item for "AI agent-building platforms," which means the oversight processes your board believes are working have a blind spot exactly where this incident lives. And now the thing probing for that blind spot might not be a person typing commands at 2 a.m. It might be a reasoning model deciding, on its own, which door to try next.

What to Ask Your CISO This Week

Three questions, none of which require a security background to ask:

1. Do we have a current inventory of every AI agent-building tool running anywhere in this company — Langflow or otherwise — and do we know who approved each one?
2. Are any of those instances reachable from the open internet, and are they running a patched, current version?
3. If an autonomous agent scanned our perimeter tonight the way Unit 42 described, would we detect it — and how many hours would pass before someone did?

Three out of 460 is not a crisis. It's a preview. The organizations that treat this as an early warning now will be the ones with an answer ready the next time the number isn't three.