Fake AI campaigns and Langflow RCE: New threats to AI agents

01Impersonated AI tools are stealing credentials at scale

The Hacker News reported that threat actors launched fake‑AI campaigns that mimicked well‑known products. The campaigns delivered malware, hijacked browser sessions, and exfiltrated business accounts. The analysis linked 1,258 public sandbox runs to these campaigns, showing a clear pattern of abuse across US companies.

What makes the attacks especially dangerous is the social engineering angle: users see a familiar AI interface, click “run”, and unknowingly hand over API keys or OAuth tokens. The reports note that 16 % of the victims were MSSP customers, meaning the pressure on downstream security teams is growing fast.

• Fake AI UI → instant trust
• Malware payloads dropped via the same download flow
• Credentials harvested for later ransomware or data theft

02Langflow’s authenticated RCE turned the platform into a launchpad

A critical authenticated remote‑code‑execution flaw (CVE‑2026‑105740) was disclosed in Langflow, an open‑source AI workflow builder. The vulnerability earned a CVSS score of 9.9 and was actively exploited in 1,423 honeypot attempts, according to The Hacker News.

Because Langflow lets agents invoke external tools and run arbitrary code as part of a workflow, an attacker who gains a legitimate user session can execute commands on the host machine. In practice, this turned a developer’s sandbox into a foothold that could reach other services, pull down secrets, or pivot to privileged accounts.

• Authenticated RCE – attacker must first log in
• Executes in the same runtime used by AI agents
• Provides a cheap path to data exfiltration

03Why agents that run code are now prime targets

Both incidents share a common thread: AI agents are trusted to invoke tools, fetch data, and write files. When an attacker can spoof the tool or compromise the orchestration engine, the agent becomes a conduit for privilege escalation.

Prompt injection is no longer the only vector. A compromised dependency or a fake service endpoint can hand the agent a malicious payload that it will execute without human oversight. This moves the risk from “bad prompt” to “malicious execution environment.”

04Hardening your agents with sandboxing, audit logs, and human approval

Deploy each agent inside a sealed microVM that isolates the kernel, limits the visible filesystem to a single workspace, and enforces a strict allow‑list for outbound connections. This creates a zero‑trust boundary around the agent’s network activity.

Use an egress broker to inject real API keys only on the way out. Inside the sandbox, the agent sees a placeholder, so even if the agent’s code is compromised it cannot directly read credentials. Couple this with a two‑person rule for actions that request new keys or modify the allow‑list.

Enable continuous checkpointing before any risky step. A snapshot that takes about 0.7 seconds can be rewound in roughly half a second, letting you revert a compromised run without losing state.

• Seal each agent in its own microVM
• Allow‑list only trusted hosts (e.g., api.anthropic.com)
• Place real secrets on the host, inject via egress broker
• Checkpoint before network calls; rewind on detection

05Monday‑morning checklist for secure AI agents

1. Verify that every agent runs in a sealed microVM and that the workspace mount is read‑only unless you explicitly add :rw.

2. Review the egress allow‑list: reject any host that is not required for the agent’s function. Add the AI vendor’s API endpoint only.

3. Run kosa8 checkpoint sealed --label "before external call" before any step that reaches out to the internet. Keep the checkpoint ID logged.

4. After the call, inspect the audit log with kosa8 audit verify to ensure no unexpected files were created or modified.

5. If the step involves a new secret, require two named approvers and record the decision in the hash‑chained audit.

• Lock down filesystem visibility
• Enforce strict network allow‑list
• Checkpoint, audit, rewind if needed