decrypted · 6 august 2026 · vulnerabilities and patching · supply chain · ai and llm security

The AI agent-builder that handed out master keys, and the worm that outran code review

CISA spent the first days of August adding three actively exploited flaws to its Known Exploited Vulnerabilities catalogue, and the most instructive one for a UK boardroom isn't the familiar name. Sitting alongside a repeat appearance from N-able N-central, whose incomplete patch we covered here yesterday, was an unauthenticated remote code execution flaw in IBM Langflow, the open-source, low-code tool thousands of teams use to build AI agents and chatbot workflows. CVE-2026-9198 scores 9.8 out of 10 for severity and needs no credentials at all. It was fixed in July, but CISA's decision to add it to the KEV catalogue on 4 August, with a 7 August deadline for US federal agencies, says something about the pace at which the UK's new AI tooling stack is being adopted, and attacked, before most organisations have worked out who owns it.

How a "first login" endpoint became a takeover

Langflow ships with an endpoint called auto_login, built to smooth a developer's first run: call it, and it hands back a superuser access token, no password required, no check on where the request came from. Sitting next to it is a second endpoint, validate/code, whose job is to check submitted code before it runs, but which actually executes it. Individually, each is a defensible engineering shortcut. Chained together, they are a skeleton key: request the first endpoint for a free superuser token, hand that token to the second, and arbitrary Python runs on the server as the most privileged user it has. No password guessing, no phishing, two API calls to a default installation. It is the equivalent of a building whose staff intercom hands a master keycard to anyone who presses the buzzer, next to a door that lets whoever is holding that card type commands straight into the building's control panel.

What Secure by Design means for the AI agent boom

The lesson here isn't that Langflow's engineers were careless; it's that secure by default has to mean the out-of-the-box experience never includes full remote code execution, however small the convenience gained. That standard should apply whether the product is a firewall console or a fast-moving open-source AI project, and UK organisations standing up their own agent-building platforms, often on servers with real network access and real credentials nearby, should treat them accordingly: patch to 1.10.1 now, keep builder interfaces off the open internet, and audit for any endpoint that mints privileged tokens before authentication. The NCSC's chief technology officer, Ollie Whitehouse, made a related point this week in a statement on recent frontier AI incidents, saying such technologies "must be developed and used from the outset with strong safeguards" and that "relying on detection alone after the fact of an incident will not be enough." He was talking about model behaviour, not tooling bugs, but the principle transfers directly: security bolted on after deployment is already too late, whether the weak point is the model or the scaffolding built around it.

Also this week

The npm worm that moved faster than review. On 4 August, attackers compromised the GitHub account behind keyv, a caching library used across the JavaScript ecosystem, and pushed malicious releases that harvested npm, GitHub, AWS and Kubernetes credentials through a script that ran automatically on install, before any human reviewed a line of code. The worm then used stolen maintainer tokens to poison further packages on its own, reaching 444 package names and over 2,000 versions within about four hours, including releases published under the account of UK food delivery firm Deliveroo. Unlike the North Korea-linked phishing campaign we covered last week, this one propagated itself once it had a foothold, which is the part UK engineering teams should sit with: a lockfile pin protects against a bad update, not against a trusted dependency that turns hostile overnight.

A cluster protocol that failed open, not closed. Apache Tomcat's CVE-2026-34486, patched back in April, has now joined the KEV catalogue after researchers linked its exploitation to an AI-orchestrated hacking campaign, reportedly run by a Chinese-speaking actor using an AI model to automate the attack chain. The bug itself is a simple, telling failure: when Tomcat's cluster encryption fails to decrypt a message between nodes, it forwards that message anyway instead of dropping it. A control built to fail closed was shipped to fail open, and it sat unexploited for months until something, human or automated, went looking for exactly that class of mistake.

Sources

If you're weighing up how much trust to hand your own AI tooling stack, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.