decrypted · 4 september 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

The AI builder that ran code before it checked who was asking

The freshest security story of the day is not a lab demo, it is live exploitation with a UK fingerprint on it. VulnCheck says its honeypot sensors, some of them sitting in the UK, have logged attackers hammering away at a critical flaw in Langflow, the open-source platform teams use to build AI agents and chatbots without writing much code themselves. Detections went from fifty in a few hours on 30 August to 360 by the start of this week, nearly all of it from Russian IP addresses, and it has nothing to do with this morning's Artifactory story: this is a different vendor, a different bug class, and it is happening right now.

A form field that runs as root

The flaw, CVE-2026-0768, sits in the "validate" endpoint of Langflow's custom component editor and carries a CVSS score of 9.8. In plain terms: the editor lets a user type a snippet of Python to define a custom building block, and Langflow hands that text straight to Python's own exec() function to run it. No authentication is required to reach the endpoint, and the process runs as root. It is the equivalent of a customer feedback box that, instead of storing what you write, immediately carries out whatever instruction is in it, with the manager's keys already in the lock, and never once asks who you are.

Attackers exploiting it are not smashing things up, they are quietly rifling through the drawers. VulnCheck's logs show queries for LANGFLOW_SUPERUSER, OpenAI and AWS credential environment variables, the contents of Langflow's own secret key file, and checks on SSH access and shell history, all consistent with harvesting credentials to pivot further into a network. The flaw was reported through Trend Micro's Zero Day Initiative in July 2025 and disclosed publicly in January 2026. All Langflow releases up to version 1.4.2 are affected, and a patched version is available.

The Secure by Design lesson

This is a textbook case of two decisions that should never travel together: treating user input as executable code, and skipping authentication on the endpoint that runs it. Either one alone is a bug. Both together, on a service running as root, is a standing invitation. Langflow is not an obscure product either, it sits in the fast-growing category of low-code AI tooling that UK organisations are piloting precisely because it lowers the bar to building something with an LLM behind it. That same low bar is why security review gets skipped: nobody thinks of a drag-and-drop AI builder as infrastructure that needs the same scrutiny as a database or an API gateway. It is. Any UK team running Langflow, or something like it, internet-facing or not, should check the version, patch past 1.4.2, and ask why the process needed root privileges in the first place.

Also this week

The US and UK signed a first-of-its-kind memorandum of understanding on 4 September to jointly dismantle scam centres, the operations, often linked to organised crime networks in Southeast Asia, that run the romance and investment fraud draining billions from victims. The US Attorney's Office for the District of Columbia, the Crown Prosecution Service and the National Crime Agency will run parallel investigations, share intelligence and coordinate on who prosecutes which case, with a joint disruption operation planned in London for October. The FBI's Internet Crime Complaint Center put reported crypto investment fraud losses at $8.65 billion in 2025, up 89% from $4.57 billion in 2023, and officials expect the true figure is higher still given under-reporting. It is a welcome step, but it is enforcement after the fact: the deeper fix is still the receiving bank, telco or platform declining to be the last link in the chain.

A small but genuinely welcome piece of news: Microsoft Teams will start hiding QR code images sent by anyone outside your organisation by default, rolling out from October, forcing a deliberate click to reveal them. QR codes are a favourite way to smuggle a malicious link past a user's usual instincts, and this is one of the rare cases of a major vendor shipping the secure option as the default rather than leaving it buried in an admin setting nobody finds.

Sources

If you run Langflow or similar low-code AI tooling and want a second pair of eyes on what it is exposed to, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.