This research audits seven AI orchestration platforms used in critical infrastructure and automation workflows, identifying 14 security findings related to remote code execution (RCE). The core issue is that these platforms inherit a developer-centric trust model, assuming that anyone able to modify workflows is authorized to execute code on the host system. This assumption fails in multi-tenant or network-exposed environments where unauthenticated webhooks can trigger workflows. For example, in Flowise, an unauthenticated request can perform prompt injection causing the large language model (LLM) to emit Python code, which bypasses a 38-pattern regex blocklist because dangerous libraries are pre-imported before the model is queried, resulting in RCE. Some vendors have closed reports as working as intended, indicating that the RCE is by design rather than a traditional vulnerability. The research highlights architectural issues rather than incidental bugs and stresses the need to reconsider threat models for these platforms.

The impact is the potential for remote code execution on hosts running AI orchestration platforms when exposed to unauthenticated network requests. This can lead to unauthorized code execution, compromising the host environment and any connected infrastructure such as cloud credentials, production databases, and internal APIs. Since these platforms are often deployed as multi-tenant HTTP services with webhooks, attackers can exploit prompt injection and bypass filtering mechanisms to execute arbitrary code. However, some vendors consider this behavior intentional, which may affect mitigation and patching approaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Some vendors have closed reports as working-as-intended, indicating no immediate patch may be forthcoming. Users should carefully evaluate deployment models and avoid exposing these orchestration platforms to unauthenticated network access. Restricting access to trusted users and isolating workflow modification capabilities can reduce risk. Monitoring vendor advisories and applying any future official fixes or configuration recommendations is advised.