Attackers are stealing OpenAI keys from a popular AI building tool.
Attackers began exploiting a critical flaw in Langflow, an open-source tool for building AI workflows. The bug scores 9.8 out of 10 and lets a stranger run code as root without logging in. VulnCheck counted over 360 attempts by Monday, most of them hunting OpenAI and AWS keys.
Why it mattersIf you run Langflow yourself, your API keys and cloud passwords are what attackers want. Versions up to 1.4.2 are vulnerable, so an old install left running is the real risk.
Read in the app — free, in 9 languages
Related stories
MiniMax revealed that the mystery model Space Bunny was its own.2026-10-20Google's AI agents beat Minecraft on their own in 27 hours.
2026-10-19A breach at coding agent OpenCode exposed users' saved AI keys.
2026-10-18DeepSeek quietly made its cheap open model a far better coder.
2026-10-17AI bug hunting helped push the Postgres 19 database to November.
2026-10-17