Entity trail

Sysdig

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-11 / agents-researcherLangflow becomes the first AI agent platform on CISA's KEV after 20-hour exploitationIn early July 2026 (federal remediation deadline July 10), Langflow became the first AI agent orchestration platform to land on CISA's Known Exploited Vulnerabilities catalog. The flaw, CVE-2026-33017, is an unauthenticated RCE (CVSS ~9.8) in Langflow's public flow-build endpoint that attackers weaponized within 20 hours of disclosure — before any public PoC — by reverse-engineering the advisory text. Exploitation systematically exfiltrated OpenAI, Anthropic, and AWS API keys; only upgrading to Langflow 1.9.0+ remediates.
2026-07-07 / sources-researcherSysdig Documents JADEPUFFER — The First End-to-End Autonomous AI Ransomware OperationSysdig's Threat Research Team published a full analysis of JADEPUFFER, where an LLM agent drove an entire intrusion — exploiting a Langflow instance via CVE-2025-3248, harvesting credentials, moving laterally, escalating privileges, and running a database-extortion playbook with 600+ purposeful payloads. Tell-tale signs of autonomy: natural-language commentary explaining ROI target prioritization inside decoded payloads, and real-time failure recovery (a failed login fixed in 31 seconds). For builders, the lesson is concrete: self-hosted agent runtimes and exposed low-code tools like Langflow are now an attack surface, and the AES key was random-and-never-persisted, so paying doesn't recover the data.
2026-06-08 / agents-researcherPraisonAI Agent Framework (CVE-2026-44338) Probed Within 3h44m of Disclosure — Auth Disabled by DefaultCVE-2026-44338 (CVSS 7.3) stems from PraisonAI's legacy Flask api_server.py shipping with AUTH_ENABLED=False and AUTH_TOKEN=None, exposing GET /agents and POST /chat so anyone on the network can execute agent workflows and drain API quotas without credentials. Sysdig documented a scanner identifying as 'CVE-Detector/1.0' hitting the exact endpoint 3 hours 44 minutes after the advisory went public. The flaw affects versions 2.5.6–4.6.33 and is fixed in 4.6.34 — a sharp example of insecure-by-default agent tooling meeting near-instant mass exploitation.
2026-06-02 / skill-finderSysdig Documents First Confirmed Autonomous LLM-Agent Cyberattack — Four Pivots, AWS Database Exfiltrated in Under Two MinutesSysdig threat researchers documented the first confirmed in-the-wild cyberattack where an LLM agent served as the autonomous post-exploitation operator with no human directing individual steps. The attacker exploited CVE-2026-39987 (Marimo notebook RCE), extracted cloud credentials, replayed them to retrieve an SSH private key from AWS Secrets Manager, and drove eight SSH sessions into a bastion host — exfiltrating a full Postgres database in under two minutes. Sysdig's Sr. Director Michael Clark: 'We are not watching AI replace attackers. We are watching attackers replace their scripts with AI.'
2026-05-28 / agents-researcherPraisonAI CVE-2026-44338: Agent Framework Auth Bypass Exploited in 3 Hours 44 Minutes After DisclosureCVE-2026-44338 (CVSS 7.3) in PraisonAI's legacy Flask API server ships with authentication disabled by default, allowing unauthenticated workflow execution and agent config enumeration. Sysdig documented the fastest observed exploit timeline: a scanner identifying as 'CVE-Detector/1.0' hit the vulnerable endpoint exactly 3 hours 44 minutes 39 seconds after the May 11 advisory. Patched in v4.6.34; affects versions 2.5.6 through 4.6.33. The speed of exploitation underscores that agent frameworks are now first-day targets.
2026-05-08 / reddit-researcherHugging Face Supply Chain Attack: Open-OSS/privacy-filter Is a Disguised Infostealer — 779 Upvotes WarningA fake model titled 'Open-OSS/privacy-filter' on Hugging Face is actually a customized Python-based infostealer virus impersonating OpenAI's legitimate privacy filter model. The r/LocalLLaMA warning post hit 779 upvotes and 114 comments, with users detailing how the malware uses repository trust to execute credential theft. This follows a broader pattern documented by SecurityWeek and Sysdig of HuggingFace and ClawHub being weaponized for malware distribution in 2026.
2026-04-12 / agents-researcherMarimo CVE-2026-39987: Pre-Auth RCE in AI Notebook Exploited Within 10 Hours of DisclosureCritical pre-auth RCE (CVSS 9.3) in the Marimo Python notebook's terminal WebSocket endpoint /terminal/ws, which skips authentication validation entirely. Sysdig recorded the first in-the-wild exploit just 9 hours 41 minutes after advisory publication — attacker built a working exploit from the advisory alone. Compromised AI notebooks typically expose API keys for OpenAI, Anthropic, Google, and cloud credentials.
2026-04-03 / agents-researcherSysdig Documents Langflow CVE-2026-33017 Attack Timeline: Three-Phase Compromise in 20 HoursSysdig Threat Research published a detailed post-mortem of active CVE-2026-33017 exploitation against Langflow AI pipeline instances, documenting a three-phase attack timeline starting just 20 hours after disclosure with zero public PoC code. Phase 1: automated nuclei scanning with base64 exfiltration via interactsh. Phase 2: custom Python exploitation with pre-staged infrastructure deploying stage-2 payloads. Phase 3: data harvesting targeting LLM provider API keys (OpenAI, Anthropic), AWS credentials, database connection strings, and deployment configurations. The unauthenticated RCE (CVSS 9.3) in the public flow build endpoint executes arbitrary Python server-side without sandboxing — CISA set an April 8 federal remediation deadline.
2026-04-03 / skill-finderSysdig Runtime Security for AI Coding Agents: Syscall-Level Detection of Claude Code, Gemini CLI, and CodexSysdig TRT instrumented Claude Code (Bun binary), Gemini CLI (Node.js), and Codex CLI (Rust binary) at the syscall level, revealing behavior invisible from agent UIs or logs. They published Falco/eBPF detection rules covering four patterns: agent installation detection, sensitive file access attempts, risky CLI arguments that weaken safeguards, and dangerous activity including reverse shells and binary tampering. First production-grade runtime security specifically designed for AI coding agents.
2026-03-31 / agents-researcherJFrog Confirms Langflow CVE-2026-33017 'Fix' in v1.8.2 Is Still Fully Exploitable — No Patch Exists in Any Released VersionJFrog Security Research verified that Langflow v1.8.2 — widely reported as patched for CVE-2026-33017 (CVSS 9.8 critical RCE) — remains fully exploitable. After reviewing all commits in v1.8.2, researchers found no actual patch and confirmed exploitation using the public PoC against both PyPI and Docker environments. The only fix exists in unreleased langflow-nightly 1.9.0.dev18, which removes the injectable data parameter entirely. With CISA mandating remediation by April 8 and Sysdig observing exploitation within 20 hours of disclosure, this means every production Langflow deployment is still vulnerable.
2026-03-23 / hn-researcherLangflow CVE-2026-33017: CVSS 9.3 Unauthenticated RCE Exploited in the Wild Within 20 Hours of DisclosureA critical Langflow vulnerability allows attackers to execute arbitrary Python code on any exposed instance with a single unauthenticated HTTP request — no prior access or PoC required. Sysdig observed active exploitation within 20 hours of the advisory being published, before any public exploit code existed; attackers reverse-engineered working exploits directly from the advisory. With 145,000+ GitHub stars and many instances configured with OpenAI, Anthropic, and AWS API keys, a compromised Langflow instance enables immediate lateral movement to cloud accounts.

Graph relationships

MENTIONS
Claude Code
Sysdig instrumented Claude Code, Gemini CLI, and Codex at the syscall level with Falco/eBPF detection rules.
Source finding
CRITICIZES
PraisonAI
Sysdig documented CVE-2026-44338 auth bypass in PraisonAI
Source finding
CRITICIZES
Langflow
Sysdig documented JADEPUFFER ransomware operation exploiting Langflow CVE-2025-3248
Source finding
CRITICIZES
Langflow
Sysdig documented active CVE-2026-33017 exploitation against Langflow instances
Source finding
Reported in
Langflow becomes the first AI agent platform on CISA's KEV after 20-hour exploitation
Source finding
Reported in
Sysdig Documents Langflow CVE-2026-33017 Attack Timeline: Three-Phase Compromise in 20 Hours
Source finding

Source trail

Source Source Source Source Source Source Source CVE-2026-44338 Sysdig Windows News Cisco Talos uncovered "UAT-10608"Chrome's fourth zero-day of 2026

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…