AI Agent Automates Ransomware via Langflow RCE Exploits

The era of fully autonomous ransomware attacks, orchestrated by AI agents, is no longer theoretical; it is an active, escalating threat. This stark reality is driven by critical remote code execution (RCE) vulnerabilities within the Langflow platform, which threat actors are exploiting to automate intrusion, data exfiltration, and the ultimate weaponization of database ransomware attacks. The JADEPUFFER AI agent, specifically, has been identified as pioneering the first documented ransomware incident executed entirely by an AI agent, leveraging CVE-2025-3248 to devastating effect. Researchers at Sysdig detailed how this agent orchestrated automated intrusion, credential theft, lateral movement, and the encryption and wiping of a production database, harvesting API keys for AI services, cloud credentials, and crypto wallet keys. This was not a human-assisted operation; it was a machine making decisions and executing attacks. The subsequent discovery and rapid exploitation of CVE-2026-33017, an unauthenticated RCE affecting Langflow versions prior to 1.9.0, further cements the severity of this systemic failure. Attackers developed working exploits within 20 hours of public disclosure, bypassing the need for published proof-of-concept code entirely. This indicates a sophisticated, proactive threat landscape where vulnerabilities are weaponized with unprecedented speed. Note what this means: the integration of AI capabilities into core infrastructure components like Langflow creates a hyper-efficient attack surface. When a platform designed to connect AI models to critical business systems contains fundamental RCE vulnerabilities, it transforms from a productivity tool into a launchpad for autonomous cyberwarfare. The economic incentive for threat actors to automate these processes is clear: reduced operational costs, increased attack velocity, and the ability to scale campaigns globally without human intervention. Why does this keep happening? Because the industry prioritizes rapid feature deployment over foundational security, repeatedly exposing unsandboxed `exec()` functions and relying on implicit trust in user-supplied code, a pattern eerily reminiscent of past supply chain compromises. ## Langflow: A High-Value Target for AI Agent Ransomware The open-source Langflow platform, designed for building AI agents and workflows, has inadvertently become a critical node in the cybersecurity supply chain. Its primary function—to centralize connections to AI models, vector databases, and cloud infrastructure—makes it an exceptionally high-value target for adversaries. A single compromise can cascade across an entire digital ecosystem. The rapid succession of RCE vulnerabilities, including CVE-2026-33017 and CVE-2025-3248, has turned this theoretical risk into an active reality. Organizations running vulnerable Langflow instances are effectively providing a direct, unauthenticated conduit for AI agents to access and control their most sensitive data and infrastructure. > ⚠️ BreachModal Insight: The speed at which threat actors weaponized CVE-2026-33017, developing exploits within 20 hours without public PoC code, demonstrates an unparalleled level of agility and resource allocation by sophisticated adversaries. This is not opportunistic scanning; it is targeted, rapid-response exploitation. [Visual Graphic 1] ## The Critical Chain of Langflow RCE Vulnerabilities The exploitation of Langflow's RCE flaws is not an isolated incident but a pattern of systemic insecurity. Multiple CVEs underscore a fundamental design deficiency where user-supplied code is executed without adequate sandboxing or authentication. * CVE-2026-33017 (CVSS 9.3/9.8 Critical): This unauthenticated RCE affects all Langflow versions prior to 1.9.0. It leverages an unsandboxed `Python exec()` call in the publicly accessible `/api/v1/build_public_tmp/{flow_id}/flow` API endpoint. This vulnerability is a direct successor to CVE-2025-3248, indicating a failure to fully address the root cause in previous patches. The CISA Known Exploited Vulnerabilities (KEV) catalog contains similar RCEs, highlighting the persistent threat of unsanitized code execution. * CVE-2025-3248 (CVSS 9.8 Critical): Affecting Langflow versions prior to 1.3.0, this unauthenticated RCE stems from unsafe code validation logic exposed via the `/api/v1/validate/code` endpoint. Malicious Python payloads, embedded in decorators or default arguments, trigger code execution during parsing. This vulnerability is explicitly listed in the CISA KEV catalog, confirming its active exploitation in the wild. * CVE-2026-33309 (CVSS 9.9 Critical): Also patched in version 1.9.0, this RCE allows an authenticated attacker to achieve arbitrary file writing via path traversal in the `POST /api/v2/files/` endpoint, leading to RCE. The ease with which an authenticated attacker can achieve RCE by simply crafting a multipart upload request is a severe oversight. * CVE-2025-34291 (CVSS 9.4): This chained vulnerability, affecting versions up to 1.6.9, enables account takeover and RCE. It combines overly permissive CORS, a lack of CSRF protection on the token refresh endpoint, and the inherently risky code validation endpoint. This allows attackers to hijack sessions and execute arbitrary code. * CVE-2026-5027 (CVSS 8.8 High): A path traversal issue in `POST /api/v2/files` allows unauthenticated attackers to write files to arbitrary system locations, often leading to RCE, especially when Langflow's default unauthenticated auto-login is enabled. This negligence is a recurring theme. * CVE-2026-7687: An RCE vulnerability in versions up to 1.8.4, specifically a command injection flaw in `CodeParser.parse_callable_details` within `src/lfx/src/lfx/custom/code_parser/code_parser.py`, allowing authenticated command execution. The fact that a core parsing function could be leveraged for command injection speaks volumes about the lack of secure coding practices. * CVE-2026-0769: A critical `eval` injection RCE in `eval_custom_component_code` allows unauthenticated attackers to execute arbitrary Python code due to insufficient input validation. The repeated use of `eval()` with untrusted input is a fundamental security anti-pattern. * CVE-2026-10560 (CVSS 8.2): This missing authentication vulnerability in `/api/v1/build_public_tmp/` affects Langflow OSS versions 1.0.0-1.9.6, enabling unauthenticated information disclosure and denial of service. If you were the CISO here, you would have seen the pattern of unauthenticated access and code execution as a flashing red light for months. Organizations that fail to disclose within 72 hours of discovery are choosing silence over user safety. [Visual Graphic 2] ## Threat Actors and Exploitation Tactics The exploitation of Langflow vulnerabilities is diverse, indicating a broad appeal to various threat actor profiles, from state-sponsored groups to financially motivated cybercriminals. * JADEPUFFER's AI-Driven Ransomware: Sysdig identified JADEPUFFER as the pioneering AI agent. It exploited CVE-2025-3248 to automate every stage of a database ransomware attack, from initial intrusion to the encryption and wiping of a company's production database. JADEPUFFER harvested sensitive data including API keys for OpenAI, Anthropic, DeepSeek, Gemini, cloud credentials for Alibaba, Tencent, AWS, Google, Azure, and crypto wallet keys. It also established persistence and compromised Nacos instances using CVE-2021-29441 and default signing keys. * Financially Motivated Actors: These groups rapidly transition from automated scanning for exposed Langflow instances to targeted credential exfiltration. Within hours of initial access, they harvest critical API keys and database connection strings, recognizing the immediate financial gain from compromising a platform that centralizes access to numerous downstream services. * Monero Cryptominers: Threat actors are actively exploiting CVE-2026-33017 to deploy XMRig Monero cryptocurrency miners. These attacks involve running attacker-supplied Python scripts to launch remotely hosted shell scripts, which act as droppers, check for existing cryptominers, download the XMRig binary, and propagate laterally using reused SSH keys. This is a classic example of leveraging an RCE for resource hijacking. * Flodrix Botnet: CVE-2025-3248 has been instrumental in distributing the Flodrix botnet malware, primarily for Distributed Denial of Service (DDoS) attacks. The scale and automation offered by the RCE make it ideal for expanding botnet infrastructure. * MuddyWater: The Iranian state-sponsored group, MuddyWater, has been linked to the exploitation of CVE-2026-5027, demonstrating the interest of advanced persistent threat (APT) groups in these vulnerabilities for espionage or destructive purposes. * Automated Scanning and Credential Exfiltration: The overarching theme is automation. Attackers are continuously scanning for exposed Langflow instances, understanding their inherent value as a gateway to cloud environments and AI services. This constant reconnaissance ensures that newly disclosed vulnerabilities are immediately identified and exploited. The dry irony here is that a platform designed to automate intelligent workflows is now being used to automate intelligent attacks, proving that AI is a double-edged sword that cuts both ways. ## Mitigating the AI Agent Ransomware Threat Protecting against AI agent ransomware attacks requires a multi-layered, proactive defense strategy. Immediate action is paramount to prevent catastrophic data breaches and operational disruption. * Urgent Patching: This is non-negotiable. Upgrade to Langflow version 1.9.0 immediately to patch CVE-2026-33017 and CVE-2026-33309. For CVE-2025-3248, upgrade to version 1.3.0 or later. Address CVE-2026-10560 by upgrading to version 1.10.0. For CVE-2026-7687, apply the latest available patch. * Network Segmentation and Access Control: Restrict network access to Langflow instances to only trusted IP ranges. Never expose code-running endpoints like `/api/v1/validate/code` or `/api/v1/build_public_tmp` to the public internet. Implement strict firewall rules. * Enforce Strong Authentication: All Langflow endpoints must require robust authentication. Many critical vulnerabilities are unauthenticated, making this a foundational security control. Enable multi-factor authentication (MFA) wherever possible. * Secure Secret Management: Do not store cloud keys, API keys for AI services (OpenAI, Anthropic, Cohere), or provider credentials directly within the Langflow environment. Utilize dedicated, hardened secret managers (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) to store and retrieve sensitive information, keeping it isolated from internet-accessible components. * Credential Rotation: If any pre-1.9.0 Langflow instance was internet-accessible, assume compromise. Immediately rotate all API keys for configured AI services and cloud providers (AWS, GCP, Azure, Alibaba, Tencent). This must be treated as a full credential compromise event. * Input Validation and Sandboxing: Implement rigorous input validation on all user-supplied code and data. Crucially, avoid the use of `exec()`, `eval()`, or similar functions with untrusted input. If code execution is unavoidable, implement robust sandboxing mechanisms to isolate the execution environment and prevent arbitrary system access. * Web Application Firewall (WAF) and Monitoring: Deploy WAF rules to detect and block requests containing suspicious Python code patterns, common RCE payloads, or anomalous requests to code validation endpoints. Implement continuous monitoring and alerting for unexpected outgoing connections, unusual process spawns, or file modifications from Langflow instances. * Harden Associated Services: If using Nacos, immediately change the default signing key. Ensure Nacos instances are never exposed to the public internet and do not connect to their databases as the root user. * Disable Non-Essential Functionality: Temporarily disable custom component functionality or other features that allow code execution if they are not critically required for operations. This reduces the attack surface. * XSS Mitigations (CVE-2026-6600): Apply input validation to all user-supplied data, implement output encoding when rendering user content in the React frontend, and deploy strict Content Security Policy (CSP) headers to mitigate the impact of script injection attacks. > 🧠 CISO Brief: The convergence of AI automation and critical RCE vulnerabilities in platforms like Langflow represents a paradigm shift in threat modeling. Your security posture must evolve from reactive patching to proactive architectural hardening and continuous adversarial simulation. This is no longer about human attackers; it's about combating intelligent, autonomous adversaries. [Visual Graphic 3] ## Proof of Concept The following proof of concept demonstrates the exploitation of CVE-2025-3248, an unauthenticated RCE in Langflow versions prior to 1.3.0, via the `/api/v1/validate/code` endpoint. This vulnerability allows an attacker to execute arbitrary Python code due to unsafe code validation logic. ### Summary This PoC illustrates how an unauthenticated attacker can achieve remote code execution on a vulnerable Langflow instance by sending a crafted HTTP POST request to the `/api/v1/validate/code` endpoint. The vulnerability lies in the unsandboxed `exec()` call that processes user-supplied Python code. Preconditions: A Langflow instance (version < 1.3.0) accessible over HTTP/HTTPS, with the `/api/v1/validate/code` endpoint exposed. No authentication is required. ### CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ### Steps 1. Identify Target: Locate a running Langflow instance vulnerable to CVE-2025-3248. This typically involves scanning for open ports (e.g., 7860) and checking the Langflow version. 2. Craft Malicious Payload: Prepare a Python payload designed to execute a system command. This payload will be embedded within the `code` parameter of a JSON request. For demonstration, we'll execute `whoami` and capture its output. ```python python import subprocess; result = subprocess.run(['whoami'], capture_output=True, text=True); print(f'---BREACHMODAL_RCE_OUTPUT---{result.stdout.strip()}---BREACHMODAL_RCE_OUTPUT---') ``` 3. Send HTTP POST Request: Send an unauthenticated HTTP POST request to the `/api/v1/validate/code` endpoint with the crafted payload. ```http POST /api/v1/validate/code HTTP/1.1 Host: [TARGET_LANGFLOW_IP]:7860 User-Agent: BreachModal-Exploit-Kit Content-Type: application/json Content-Length: [CALCULATED_LENGTH] {