A Chinese-speaking hacker used DeepSeek to autonomously attack more than 460 systems, with only three confirmed compromises, according to a July 30, 2026 report from Palo Alto Networks' Unit 42. The o…
A security engineer evaluated seven workflow automation platforms—n8n, Activepieces, Dify, Windmill, Tracecat, Kestra, and Langflow—to build a SOC agent and found that nearly all are open core, with s…
Unit 42 researchers have uncovered a Chinese-speaking threat actor using an autonomous attack platform that combines the Hermes agent with DeepSeek's AI to conduct reconnaissance, PoC acquisition, and…
Palo Alto Networks' Unit 42 discovered a China-based threat actor using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers, with the agent ind…
A security researcher detailed an autonomous AI attack that exploited exposed Langflow, n8n, and Marimo instances but was foiled when the agent left a public web server broadcasting its own tool calls…
LangChain, LangGraph, LangSmith, Langflow, and other 'Lang' tools are often confused. A developer's guide clarifies the ecosystem: langchain-core is the foundation, langchain offers batteries-included…
Internet-exposed AI/LLM tool infrastructure has surged over 60% in the past nine months, with more than 294,000 distinct IPs now exposing one of 43 detected tools, up from ~183,000 in October 2025, ac…
Cloud security firm Sysdig reported that an agentic threat actor named JADEPUFFER is exploiting a vulnerability (CVE-2025-3248) in AI framework Langflow to deploy ransomware that destroys AI model art…
GitHub shipped CodeQL 2.26.0 on July 10 with a new static analysis query, js/system-prompt-injection, that detects untrusted user input flowing into AI model system prompts in JavaScript and TypeScrip…
AI-powered attacks are automating entire attack chains, including lateral movement via LLM-powered agents, drastically reducing the time from initial access to deep compromise, according to reports fr…
CISA added Langflow, the open-source AI workflow builder, to its Known Exploited Vulnerabilities catalog on July 7, 2026, marking the first AI agent orchestration platform in KEV, after two actively e…
Sysdig documented JADEPUFFER, a ransomware-style database extortion operation that used an AI agent to automate much of the intrusion chain, according to a July 1 technical report. The attack exploite…
Sysdig's JadePuffer report details the first fully autonomous ransomware attack executed by an AI agent. The agent exploited CVE-2025-3248 in Langflow to gain initial access, then autonomously escalat…
Multiple critical vulnerabilities in Langflow and Dify AI agent platforms have enabled remote code execution and data exposure, with one Langflow flaw exploited within 20 hours of disclosure. Security…
Sysdig Threat Research documented the first known agentic ransomware campaign, JADEPUFFER, where an AI agent autonomously exploited a vulnerable Langflow server, moved laterally, and destroyed product…
CISA added an authorization-bypass vulnerability in Langflow, a visual framework for building AI-agent workflows, to its Known Exploited Vulnerabilities catalog on July 7, 2026, giving federal agencie…
The US Cybersecurity and Infrastructure Security Agency (CISA) added a Langflow vulnerability (CVE-2026-55255) to its Known Exploited Vulnerabilities catalog after the Sysdig Threat Research Team obse…
A security researcher demonstrated the first AI-run ransomware attack, where an autonomous agent chained a Langflow vulnerability and a MySQL flaw to steal credentials, move laterally, encrypt files, …
Cloud security firm Sysdig reported the first ransomware campaign run entirely by a large language model, dubbed JadePuffer. The AI agent autonomously exploited a vulnerability in the Langflow framewo…
SigNoz released a new dashboard for monitoring Langflow applications using OpenTelemetry trace data, providing metrics on LLM token consumption, latency, model usage, agent activity, and errors to hel…