[Single source] VulnCheck catches IP Microsoft tied to AI agent exploiting Langflow
VulnCheck's decoy servers caught an IP, tied by Microsoft to an AI agent that hunts leaked secrets on GitHub, breaking into Langflow, IBM's tool for building AI agents. The actor used CVE-2025-3248, on CISA's exploited list since May 2025, ran 11 payloads in 36 minutes, and made four attempts to decrypt stored API keys. VulnCheck says the session fits the agent but traffic alone cannot prove it; anyone exposing Langflow to the internet should review the installation and protect stored keys.
In 30 seconds
VulnCheck's decoy servers caught an IP address: previously tied by Microsoft to an AI agent that hunts leaked secrets on GitHub: breaking into Langflow, IBM's tool for building AI agents. The intrusion used CVE-2025-3248, a flaw on CISA's exploited-in-the-wild list since May 2025. In a single session, the actor ran 11 payloads in 36 minutes and made four attempts to decrypt stored API keys. VulnCheck says the session fits the pattern of such an agent, but cautions that traffic alone cannot prove an agent ran it.
What happened
VulnCheck's decoy (honeypot) servers detected the IP exploiting Langflow via CVE-2025-3248, a vulnerability that has been on CISA's Known Exploited Vulnerabilities list since May 2025. The IP had previously been associated by Microsoft with an AI agent that hunts leaked secrets on GitHub, and reportedly now has new methods for gaining entry.
During the session, the actor ran 11 payloads in 36 minutes and made four attempts to decrypt stored API keys. It also went looking for files that other hackers had left behind on the target.
Why it matters
Microsoft says one such agent went from scanning GitHub to stealing Azure Key Vault secrets in five minutes, illustrating how quickly this tooling can move from reconnaissance to actual secret theft.
If an AI agent is indeed autonomously exploiting internet-facing infrastructure like Langflow and attempting to decrypt API keys, it would represent a notable escalation from passive secret-hunting on GitHub to active exploitation: though that attribution remains unproven. The targeting of a tool for building AI agents also means compromised environments may hold credentials to other AI services.
What to do
Organizations running Langflow should prioritize patching CVE-2025-3248, which has been on CISA's exploited list since May 2025 and is confirmed as the entry point used in this activity.
Teams should avoid leaving decryptable API keys stored on Langflow instances and monitor for the post-exploitation behaviors seen in this session, including rapid sequences of payloads and attempts to decrypt stored credentials.
Confirmed and still uncertain
Known: VulnCheck decoys observed the IP exploiting Langflow via CVE-2025-3248, executing 11 payloads in 36 minutes, making four attempts to decrypt stored API keys, and searching for files left by other hackers. Microsoft previously tied the IP to an AI agent that hunts leaked GitHub secrets.
Unknown and contested: whether an AI agent actually ran this session. VulnCheck says the session fits the pattern, but traffic alone cannot prove an agent was operating; who or what is behind the IP remains unestablished in the available evidence.
What people are saying
VulnCheck, as summarized in the discussion: the decoy session fits the profile of the GitHub-secret-hunting AI agent that Microsoft described, but traffic alone can't prove an agent ran it.
Microsoft, as cited: one such agent went from scanning GitHub to stealing Azure Key Vault secrets in five minutes.
Evolution
The IP's activity appears to have evolved: it was previously associated with hunting leaked secrets on GitHub, and it now shows new methods for gaining entry: specifically, exploiting Langflow via CVE-2025-3248, followed by post-access behavior such as decrypting stored API keys and looking for files other hackers had left behind.
Reach
Technical detail
The exploited flaw, CVE-2025-3248, affects Langflow: IBM's tool for building AI agents: and has been on CISA's Known Exploited Vulnerabilities list since May 2025.
Observed session telemetry: 11 payloads executed over 36 minutes; four attempts to decrypt stored API keys; and enumeration of files left behind by other attackers on the decoy. Detection occurred via VulnCheck's decoy servers, which are instrumented to catch this kind of intrusion.
Sources and evidence
This item is based on a single untrusted source: an X post by IntCyberDigest relaying VulnCheck's decoy-server findings and Microsoft's statements. The primary publications from VulnCheck and Microsoft were not included in the evidence batch.
Key claims: the agent attribution, the five-minute Azure Key Vault theft, and the exact session telemetry: are second-hand as relayed by the post and should be verified against VulnCheck's and Microsoft's original reporting before being treated as confirmed.
