Agentic Secret Hunters Exploit Langflow and Leaked AI Keys (CVE-2025-3248)

Key Takeaways

• Microsoft reported on November 5, 2026, that attackers have used agentic tooling since August to scan GitHub for exposed secrets, including AI service keys.
• In one case, an agent moved from GitHub scanning to Azure Key Vault exfiltration in about five minutes.
• On November 8, VulnCheck tied an IP address from the campaign to exploitation of Langflow CVE-2025-3248 against its canaries.
• The AI angle is twofold: AI provider keys are prime targets, and an AI workflow framework became an entry point.

Leaked Keys Become Cloud and AI Access in Minutes

Microsoft Threat Intelligence described attackers running an agentic offensive framework that searches public GitHub repositories for credentials, then signs in with them. Microsoft's report shows how fast a leaked secret now turns into access to cloud vaults, storage and AI deployments. The same activity reached Langflow, an open-source AI workflow builder, through a known critical flaw that many servers still have not patched.

What We Know

Microsoft says the searching began in August 2026, with successful service principal sign-ins observed from late October. Targeted secrets included application credentials and API keys for AI inference services.

After authenticating to Microsoft Entra ID as a workload identity, the agents enumerated subscriptions, resource groups and AI model deployments, then pulled further secrets from Azure Key Vault. Microsoft also describes access to Storage Accounts, Azure AI, Azure DevOps, SharePoint and OneDrive.

On November 8, VulnCheck reported that an IP address named by Microsoft exploited Langflow CVE-2025-3248 against its canary systems. That flaw is a critical unauthenticated code execution bug, fixed in Langflow 1.3.0 and listed by CISA as known exploited since May 2025. The canaries recorded adaptive credential hunting and decryption attempts, but only decoy data was taken.

This is a different Langflow flaw from the MCP injection already on the PointGuard AI Security Incident Tracker. Microsoft has published detection guidance for these sign-ins.

What Happened

The attack chain is simple. A developer commits an application secret or AI provider key to a public repository. An agent finds it, tests it, and signs in as the workload that owns it, usually within minutes.

Because a service principal is a non-human identity, there is no multi-factor prompt and no user to notice. The agent then explores whatever that identity can reach, recovers from failed API calls in seconds, and harvests more secrets from vaults to widen access.

Langflow adds a second door. Exposed Langflow servers hold the provider keys, database credentials and tool tokens that AI workflows need. Exploiting an old, unpatched code execution flaw gave the attackers a shell on those hosts, where the canary logs show them searching for and trying to decrypt stored credentials.

Microsoft confirmed real data exfiltration in victim environments. VulnCheck's evidence confirms the technique against Langflow, not an additional customer breach.

Why It Matters

AI keys are now currency. They unlock paid model usage, private deployments, and the data those deployments can see, so they draw the same attention as cloud admin credentials.

The campaign also shows how much autonomy changes the defender's timeline. Rotation schedules measured in weeks offer little protection when a leaked key can be used in minutes. What matters is how quickly a secret is revoked, how narrowly each workload identity is scoped, and whether anyone notices unusual sign-ins by non-human identities.

AI workflow builders such as Langflow are a growing part of this attack surface. They sit close to sensitive keys and tools, are often deployed quickly by product teams, and are not always patched with the urgency of core infrastructure.

Removing a secret from GitHub does not revoke it. Organizations should rotate exposed secrets, review service principal sign-in logs and consent grants, cut workload permissions, and patch or isolate every Langflow instance.

PointGuard AI Perspective

This campaign is a non-human identity problem first. Every step ran on credentials that belonged to applications and AI workloads, not people, and each one carried more access than its task needed.

PointGuard AI Agent Identity and Access Security gives each agent and AI workload a verifiable identity with scoped, short-lived permissions. When a leaked key is replayed from an unfamiliar source, intent-based access control can deny the request even though the credential itself is valid, and the activity is tied back to a named identity for investigation.

AI provider keys deserve their own control point. The PointGuard AI Gateway brokers model access so applications do not have to hold long-lived provider keys at all. Usage is logged per identity, spending and rate anomalies trigger alerts, and a stolen key can be cut off centrally instead of hunted down across repositories.

Langflow shows why inventory matters. PointGuard AI Discovery finds AI frameworks, agents and MCP servers running across the environment, including forgotten workflow builders exposed to the internet. Pairing that inventory with posture checks flags unpatched versions, such as releases before 1.3.0, before an agent finds them.

The lesson for security teams is speed. Agents compress discovery, testing and exploitation into minutes, so controls must act at the moment of access rather than at the next rotation cycle.

Incident Scorecard Details

Total AISSI Score: 8.10/10

Criticality: 9, Service principals, Key Vault secrets and AI service keys were reached. AISSI weighting: 25%

Propagation: 8, Access spread from leaked secrets across tenants, apps and AI platforms. AISSI weighting: 20%

Exploitability: 8, Microsoft confirmed successful sign-ins and data exfiltration. AISSI weighting: 15%

Supply Chain: 7, Exposure flows through public repositories and an open-source AI framework. AISSI weighting: 15%

Business Impact: 8, Confirmed credential and data theft across organizations; losses unquantified. AISSI weighting: 25%

Sources

Third-Party Sources

• Microsoft Threat Intelligence: Threat actors use agentic AI tooling to find and abuse exposed secrets
• VulnCheck: Microsoft's secret hunter and Langflow exploitation

PointGuard AI Sources

• PointGuard AI Incident Tracker: Attackers Exploit Langflow MCP Command Injection in the Wild
• PointGuard AI Agent Identity and Access Security
• PointGuard AI Gateway