The IP address that Microsoft tied to an agentic AI campaign hunting for secrets on GitHub was also caught exploiting Langflow, an open-source tool for building AI agents, according to security firm VulnCheck, which published the finding on 8 November. VulnCheck says its decoy servers recorded the address, 199.19.77.84, running 11 payloads against a Langflow decoy over 36 minutes on 7 November UTC.
The flaw it used, CVE-2025-3248, has been on the US Cybersecurity and Infrastructure Security Agency’s list of known exploited vulnerabilities since 5 May 2025, according to the NVD record. By our arithmetic, that is 551 days before VulnCheck saw it exploited on 7 November 2026.
Business Pill · LEAST PRIVILEGE
A short Business Engineer explainer on least privilege: giving an AI agent only the access its task needs. It teaches the general idea only and says nothing about VulnCheck, Microsoft or this activity.
The key insight: VulnCheck says the IP address Microsoft tied to agentic AI secret hunting, 199.19.77.84, exploited Langflow CVE-2025-3248 on its decoy servers on 7 November UTC. The flaw has been on CISA’s known-exploited list since 5 May 2025, which by our arithmetic is 551 days before that event.
On 5 November, Microsoft Threat Intelligence described threat actors using agentic AI tooling to hunt for secrets exposed on GitHub, VulnCheck writes. With those secrets they got into Entra ID tenants, Azure Key Vaults and Azure AI services, and in one case went from a GitHub search to Key Vault exfiltration in five minutes. VulnCheck says 199.19.77.84 was the IP at the centre of that activity, which Microsoft described as the credential-abuse address.
CVE-2025-3248 was added to CISA’s known-exploited list on 5 May 2025 (NVD record); VulnCheck says its Langflow decoy saw the IP Microsoft flagged exploit it on 7 November 2026. The 551 days are our arithmetic.
What VulnCheck Says It Saw
VulnCheck says its canaries logged 25 events from the address across three countries. On 2 November it sent probes for two PHP flaws to canaries in Sweden and Brazil; VulnCheck describes those as a check for exposure, not an exploit. On 7 November it exploited CVE-2025-3248 on a Langflow decoy in Britain, in stages that VulnCheck says moved from reading environment data to scraping for AI and cloud keys and decrypting stored variables.
VulnCheck says the Langflow activity came one day after Microsoft published, so the operator was still active with the same infrastructure. “We can’t prove from network traffic alone that an AI agent ran this session,” VulnCheck writes, adding that the session lines up with what Microsoft describes. It points to stages that depended on earlier results and to retries at machine speed.
The Flaw and the Fix
The NVD record describes CVE-2025-3248 as a code-injection flaw that lets a remote, unauthenticated attacker execute arbitrary code in Langflow versions prior to 1.3.0, rated 9.8, critical. VulnCheck’s advice is to “Get Langflow off the internet, and patch it”, and to treat every key stored in an exposed instance as exposed, rotating provider keys and then the Langflow secret key.
VulnCheck also reports a second address, which it does not attribute to the same operator, going after AI credentials in Langflow and another agent tool that week. “Exposed AI tooling has become a front door to cloud identities,” the firm writes.
As we read VulnCheck’s account, the same address reached AI and cloud keys by two routes: leaked GitHub secrets in Microsoft’s reporting, and an unpatched agent-building tool on VulnCheck’s decoy.
As we read the NVD record, the fix has existed since Langflow 1.3.0; VulnCheck’s point is that exposed, unpatched instances still hold the keys attackers want.
VulnCheck, 8 November 2026
“Exposed AI tooling has become a front door to cloud identities”
Three Implications
FOR TEAMS RUNNING LANGFLOW VulnCheck advises taking Langflow off the internet, patching it and rotating every key it stored, then the Langflow secret key.
FOR CLOUD SECURITY TEAMS VulnCheck links the session to Microsoft’s case through the shared IP address and matching behaviour, and says it cannot prove from network traffic alone that an AI agent ran it.
FOR THE AI STACK VulnCheck reports a second, unattributed address going after AI credentials in Langflow and another agent tool the same week.
The analysis describes a governance layer and says “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”
As we read it, an AI service key stored in an exposed agent tool is that access decision left open: VulnCheck says the payloads it saw went after exactly those keys. The analysis does not discuss VulnCheck’s findings or Langflow.
What Is Not Established
VulnCheck says it cannot prove an AI agent ran the session; it links the session to Microsoft’s campaign through the shared IP address and matching behaviour. The decoy was not a customer system, and VulnCheck does not say how many real Langflow servers the address reached. The 551 days are our arithmetic from the NVD record’s KEV date and VulnCheck’s event date. We did not contact VulnCheck or Microsoft.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
VulnCheck says the IP address behind Microsoft’s agentic AI secret-hunting case also exploited a Langflow flaw that has been on the government’s known-exploited list since May 2025. Its advice is to take Langflow off the internet, patch it, and rotate every key it stored.
A note on sourcing. The canary findings, quotes and summary of Microsoft’s research are from VulnCheck’s post of 8 November 2026, read in full. The KEV date, severity and affected versions are from the NVD record for CVE-2025-3248. This piece describes the flaw only in general terms.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
