Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack

Recently, we've been interested in how AI is impacting the attack surface, so we started researching AI-assisted vulnerability discovery and AI-targeted technologies for our 1H-2026 State of Exploitation report.

While researching the report, we dug into the AI technologies attackers targeted and exploited during the first half of 2026. The report only had room for a high-level overview. This blog takes a closer look at what was targeted, how it was exploited, and what those trends reveal. Let's dive in, focusing on Langflow.

What is Langflow?

Langflow is an open source project that bills itself as a powerful platform for building and deploying AI-powered agents and workflows.

It's known as "one of the fastest growing open source low-code AI tools" and was acquired by IBM in 2024 through its DataStax acquisition. On GitHub, Langflow has over 399 contributors, 153,000 stars, and 9,900 forks, highlighting wide product adoption.

Exploitation Activity Targeting Langflow

Before 2026, evidence showed only one Langflow vulnerability known to be exploited in the wild. In 2026, things have changed fast. We've now seen 11 additional vulnerabilities targeted and reported as exploited in the wild, highlighting increasing attacker interest in Langflow.

Looking across confirmed exploitation attacks we've seen in VulnCheck Canaries targeting Langflow, we've observed 15,000+ successful attempts leveraging CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027 vulnerabilities.

Internet Exposure of Langflow

When we look at active vulnerable hosts on the internet, VulnCheck Target Intelligence gives us visibility into hundreds of Langflow hosts still active and vulnerable, with the highest concentration in the United States.

So Why are Attackers Targeting Langflow and other AI Tooling Infrastructure?

AI products are being adopted at an unprecedented rate. Many are also new, so they can (and do) overlook security first principles.

Langflow’s first deployment model is designed to be deployed as an internet accessible service, allowing public access to your project’s MCP server provides a shareable playground where external users interact with the flow’s chat input and output and view results without having to install Langflow or generate an API key. This increases the probability of internet exposure. And while Langflow does provide security best practices, it’s likely there are plenty of new adopters that brush over the best practices.

Langflow and similar AI projects often have access to compute resources, keys to systems with sensitive data and exposure to other high value systems. In layman's terms, the exact type of system an attacker would find very valuable.

Exploring the Actions of Two Different Attackers

So naturally, our team noticed the potential for attackers to target Langflow earlier this year and spun up VulnCheck Canaries, real vulnerable instances of Langflow, to see how and why different attackers leverage Langflow.

Attacker 1 - Grab the Creds and Run

The first attacker we observed hitting a canary appears to be looking to extract credentials from the Langflow host. They leveraged CVE-2026-5027, an Upload Path Traversal Arbitrary File Write vulnerability that provides remote code execution. Over the following two weeks, they dropped a Python credential harvester, proxy agents, and a SimpleHelp RAT installation. They ran the credential harvester to extract credentials, then established IRC C2.

Attacker 2 - Spin Up the Miners and Find Some More Targets

The second attacker we observed hitting a canary appears to be running a cryptomining campaign. They started by gaining initial access using CVE-2025-3248, which allows a remote, unauthenticated attacker to send crafted HTTP requests to execute arbitrary code. The attacker then deployed a proxy agent and established a connection with C2 infrastructure, before spinning up an XMR crypto miner. They then disabled auditd, resulting in a forensic blind spot, and exploited CVE-2026-0769 to drop .sysd. From there, the attacker pivoted to scan for other targets, likely to expand their cryptomining operation, and moved on to another host.

Two Different Attacks w/ Different Intentions

As new AI technology proliferates, attackers are expanding to target this new attack surface. The attacks we observed highlight the use of different vulnerabilities and tactics against the same technology. One attacker appears interested in extracting credentials from the host, likely to gain broader access across the enterprise. The other appears focused on expanding their cryptomining operation. Both use different tactics and techniques along the way, but their goals appear to be aligned and financially motivated. This highlights the importance of considering the exposure organizations face as they race to adopt the latest AI technology, often without weighing the risk trade-offs that come with it.

About VulnCheck

VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.

We knew that we needed better data, faster across the board, in our industry. So that’s what we deliver to the market. We’re going to continue to deliver key insights on vulnerability management, exploitation and major trends we can extrapolate from our dataset to continuously support practitioners.

Are you interested in learning more? If so, VulnCheck's Exploit & Vulnerability Intelligence has broad threat actor coverage. Register and demo our data today.