Hackers Exploit Langflow to Steal AI and Cloud Keys in Microsoft-Linked Campaign

An IP address that Microsoft tied to an AI hacking tool has a new way in. Security firm VulnCheck says the address, 199.19.77.84, broke into one of its decoy servers running Langflow.

Langflow is an open-source tool for building AI agents. IBM agreed in 2025 to buy its parent company, DataStax. VulnCheck published its findings on November 8.

Microsoft’s Research Findings

Microsoft’s report came out on November 5. It says attackers use an AI framework called ARTEX. The vulnerability scan hunts through GitHub code for leaked credentials and keys. This practice started from August 2026 and would combine a name of a company with phrases related to cloud or AI software.

After that, the malware made use of the stolen keys. Microsoft reported successful log-ins by the machine 199.19.77.84 as of October 28. The machine targeted many applications within various organizations. In one instance, an attacker moved from searching on GitHub to extracting information from the Azure Key Vault in only five minutes.

Microsoft also saw the tool fix its own mistakes. After failed requests, it tried again 28 to 80 seconds later with corrected settings. Meanwhile, Todyl counted at least 27 affected organizations. Huntress saw the actor get Azure tokens in four customer tenants.

Those reports covered keys stolen from GitHub. VulnCheck, however, saw another route. Its decoy servers, which it calls canaries, logged the same IP exploiting Langflow. The exploit takes advantage of CVE-2025-3248, which has a score of 9.8 out of 10 and allows arbitrary code execution without authentication. Versions before 1.3.0 have the bug. CISA added it to its exploited-flaws list in May 2025.

The session ran on the evening of November 6 in U.S. time zones. That was one day after Microsoft went public. So the operator kept using the same infrastructure.

What the Attacker Did

In less than an hour (36 minutes, to be precise), the attacker launched 11 payloads. Each action followed the previous one. First, it dumped system settings and hunted for files that hold secrets. Next, it mapped the server. Then it searched logs and saved workflows for keys tied to AI and cloud providers.

Finally, it went after the keys Langflow stores in encrypted form. The attacker made four attempts to decrypt them. It tried Langflow’s own functions first. After that, it searched the code and tested guesses built from the server’s secret key. The last method worked. On a real server, though, that would expose real provider keys. On the decoy, it found only fake data.

The attacker also looked for files other hackers had left behind. Some came from a cryptomining crew that hit the same decoy two days earlier. One code comment called them “leftover scripts of other actors.”

Was an AI Agent Behind the Attack?

VulnCheck took a careful stance here. Network traffic alone can’t prove an AI ran the session. Still, several clues match Microsoft’s account.

For example, later payloads used results from earlier ones. By contrast, a fixed attack kit would send the same code everywhere. In addition, the decryption retries took about 80 seconds, and each failure led to a new variation.

Some code carried plain-English comments, which VulnCheck calls typical of generated code. Also, the key searches focused on AI providers, as Microsoft saw too.

Other Attackers Use the Same Playbook

Another address, namely, 179.43.191.82, ran a similar attack on the Brazil-based decoy from VulnCheck on November 2. It uncovered secrets of Langflow and attempted to harvest Azure identity tokens; however, VulnCheck does not associate it with the same operator. According to the company, exposed AI tools become a way into cloud accounts.

Furthermore, ARTEX is employed by other entities as well. In particular, in October, Microsoft associated it with the Storm-0940 threat actor based in China in connection with a supply chain operation. Another group of criminals, namely, Storm-3358, exploited it for attacks against financial institutions.

The Bigger Picture

AI tools have become both a target and a weapon. Attackers now use agents to steal the keys behind other people’s agents. VulnCheck notes this attacker needed about half an hour to reach a working decryption method. At that speed, patch cycles measured in weeks leave a wide gap.

This trend is not limited to attacks on exposed AI tools. Anthropic has also reported that suspected ShinyHunters affiliates used Claude AI agents to automate cyberattacks, highlighting how threat actors are increasingly turning AI systems into tools for malicious operations.

What Defenders Should Do

• Lock down Langflow. Upgrade to version 1.3.0 or later and secure it using a login or private network.
• Assume the keys are gone. If the server was reachable, rotate every provider key. Then rotate Langflow’s own secret key.
• Check for leftovers, odd files, miner processes and unknown scheduled jobs.
• Clean up GitHub. Remove secrets from code and rotate them. Microsoft warns that deleting a file doesn’t cancel a leaked key.
• Watch behavior. Attackers change IPs and code quickly, so blocking one address falls short.