Threats tagged 'ai platform exploitation'

CVE-2026-0768 is an unauthenticated remote code execution vulnerability in the Langflow AI application-building platform disclosed in January 2026. It allows arbitrary Python code execution via decorator and default-argument evaluation on the validation endpoint without authentication. In September 2026, F5 Labs observed 405 exploitation attempts from 55 IP addresses, marking the first known opportunistic internet-wide scanning targeting an AI/ML development platform. Attackers used payloads for capability probing, timing checks, and environment harvesting to extract cloud credentials, API keys, and database secrets. The activity originated mainly from Google Cloud hosts and European scanning subnets using forged and spoofed headers. Public exploit code is available via Metasploit, and detection templates exist for this vulnerability.