Attackers are stealing OpenAI keys from a popular AI building tool.
Attackers began exploiting a critical flaw in Langflow, an open-source tool for building AI workflows. The bug scores 9.8 out of 10 and lets a stranger run code as root without logging in. VulnCheck counted over 360 attempts by Monday, most of them hunting OpenAI and AWS keys.
Why it mattersIf you run Langflow yourself, your API keys and cloud passwords are what attackers want. Versions up to 1.4.2 are vulnerable, so an old install left running is the real risk.
Read in the app — free, in 9 languages
Related stories
Runway's new model generates a playable world at 24 frames a second.2026-09-05Outside testers scored OpenAI's new Astra below Anthropic's Fable 5.1.
2026-09-05A startup's AI found six curl flaws after OpenAI's found none.
2026-09-04Google's cheapest new model doubles in price on 1 January.
2026-09-04Meta's new model tells 20 speakers apart while they talk at once.
2026-09-04