VulnCheck's decoys caught an IP address from Microsoft's agentic secret-hunting report running an 11-stage Langflow exploitation session
VulnCheck says IP address 199.19.77.84, which Microsoft's November 5 post tied to service-principal abuse from October 28, ran 11 Langflow payloads over 36 minutes against its decoy servers on November 7, sending 10 of them twice, exploiting CVE-2025-3248 and ending by decrypting stored variables and dumping database tables; on November 2 the same address sent PHP probes. VulnCheck says it "can't prove from network traffic alone" that an AI agent ran the session, pointing instead to dependent stages and machine-speed retries. The link to Microsoft's actor is VulnCheck's inference from the shared address, not an attribution by Microsoft.
A flaw an AI model found is being exploited in the wild — the second of 286 CVEs a tracker attributes to Mythos and Project Glasswing
VulnCheck’s Patrick Garrity reported that the firm’s Canary Intelligence network began picking up exploitation of CVE-2026-61500 in Rejetto HFS — the authentication bypass Horizon3 found with Anthropic’s Mythos — on the evening of Thursday October 1: “We started detecting exploitation of CVE-2026-61500 in Rejetto HFS this evening,” and “Our canaries detected an actor in China targeting real vulnerable hosts in the US,” with Japan also among the targets. The next day he recorded four hits from two US addresses in one subnet, 173.239.211[.]248 and 173.239.211[.]249, which “appear to be coming from a proxy.” The number that places the event: as of that Friday Garrity’s tracker counted 286 CVEs attributed to Mythos and Project Glasswing, and until the Thursday evening only one of them had been exploited in the wild. The bug is a critical authentication bypass leading to full admin access and remote code execution in Rejetto HFS, and the account read here tells users to update to v3.2.1 or later. Accounts of the timing differ: Security Affairs, reading the same VulnCheck material on October 5, dates the report of the probes to October 2 and describes the activity as small-scale reconnaissance only, from a single China Telecom address probing canary deployments in Japan and the United States. No affected organisation is named in either account.
Horizon3 says Anthropic's Mythos linked a predictable random number generator to a separate leak endpoint, reached for an SMT solver unprompted and wrote the working exploit
Zach Hanley of Horizon3.ai published “Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS” on September 30, an account of how CVE-2026-61500, “Rejetto HFS Session Forgery via Predictable Signing Key”, was found. Horizon3 ran a cryptographic-weakness analysis agent driven by Mythos across the TypeScript rewrite of HFS. It flagged V8’s Math.random() as the source of the cookie-signing key, found a separate endpoint leaking raw Math.random() output to clients, and a follow-up verifying agent re-checked the claim against the code and confirmed it: “It did not require follow-on prompting to find the disparate PRNG leak that made this theoretical issue a demonstrable one.” It also identified the user-enumeration weakness the chain needs, and then, in Horizon3’s words, “Mythos then created the working proof of concept exploit” — enumerate the admin user, sample twelve leaked outputs, feed them to a Z3 solver to recover the generator state, step the state back to the signing key, forge an admin session cookie and run code — with the solver its own idea: “It did not require instruction to go out and research approaches to “solve” a complex mathematical problem.” Hanley writes that flaws needing significant time to understand and exploit were previously unlikely to be prioritised and that “Mythos negates both of those reasons”, and that “Our use of Mythos thus far has exceeded what we thought was possible without significant harness engineering.” The post gives no duration for the work and no estimate of what a human would have taken. The companion username-enumeration advisory, CVE-2026-61503, was published through the VulnCheck CNA on July 13 and credits “Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research”. Nobody outside Horizon3 has reproduced the division of labour it describes.
A flaw in DeepSeek's agent harness let a sandboxed agent turn its own confinement off with one command
OX Research disclosed CVE-2026-82533 in DeepSeek Harness, in which the local agent-control API “read the 'Host' request header and allowed access if the value was a loopback authority” but “never compared that value with the connection's actual peer address,” so that “a sandboxed AI agent could use a single shell command to call that API and elevate its own session to 'danger-full-access' with approval prompts disabled.” The OpenCVE record, published September 8 with VulnCheck as the assigning authority, covers all versions before 0.1.2-alpha.1 and carries CVSS 9.4 under v4.0 and 9.6 under v3.1. OX says the fix shipped in 0.1.2-alpha.1 on August 27 and that it re-tested the patched build on August 30; it demonstrated the flaw on a default installation and claims no exploitation in the wild.
Attackers move to mass exploitation of a critical Langflow flaw, harvesting AI and cloud credentials
VulnCheck reported more than 50 exploitation attempts within hours on Aug 30 against CVE-2026-0768, an input-validation flaw in the Langflow AI workflow builder that allows arbitrary Python execution in the context of the root user, rising to more than 360 by Sep 1. VulnCheck's Caitlin Condon says attackers queried environment variables including LANGFLOW_SUPERUSER and OpenAI and AWS credentials, read the cached Langflow secret key and checked SSH access and bash history, then dropped Python credential harvesters and proxy agents, deployed XMR miners and disabled audit logging.
VulnCheck logs more than 15,000 successful exploitation attempts against Langflow
VulnCheck reports its canaries recorded over 15,000 successful attempts against Langflow leveraging three CVEs, with one attacker deploying credential harvesters, proxy agents and remote-access software with IRC command and control and cron persistence, and a second deploying cryptocurrency miners, SOCKS5 tunnels and disabled audit logging before pivoting to scan further targets. It states that before 2026 only one Langflow vulnerability was known to be exploited in the wild, and that eleven more have been reported exploited during 2026.
VulnCheck says AI write-ups and placeholders now outnumber working exploits in public proof-of-concept repositories
VulnCheck reviewed about 20,000 public exploits and vulnerability analyses in 2025 and more than 17,800 proof-of-concept submissions by mid-August 2026, with its GitHub acceptance rate falling to roughly 45% from about 51% over the past couple of years. It says the leading rejection reason is a repository that “contains no exploit code to begin with,” and that “stylized AI write-ups and placeholders are more common than actual AI PoCs, fake or otherwise.”
METR finds vulnerability disclosures rising far faster than confirmed exploitation
METR reports cURL CVEs rising from 9 in 2025 to 36 through mid-2026 with 15 of the 36 AI-marked, OpenSSL from 6 to 39 through early August 2026 with 18 corroborated as AI discoveries, Firefox from 210 to 342 with 11% AI-marked, and Microsoft security-update CVEs from 1,243 to 1,927 with 26 carrying any AI marker. It reports VulnCheck known-exploited entries growing about 10% against 45% growth in CVE volume, a drop in the exploited-to-disclosed ratio.
VulnCheck finds AI-discovered vulnerabilities are exploited in the wild at the same low rate as any other
In its State of Exploitation report for the first half of 2026, VulnCheck found that of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 — about 1.3% — were confirmed exploited in the wild, matching the overall exploitation rate for the period. The firm concluded that AI is so far increasing the volume of vulnerabilities discovered rather than the share attackers actually use.