When the AI Writes the Attack: CVE-2025-3248, the Langflow RCE, and LLM-Driven Intrusions

There is a particular kind of irony in CVE-2025-3248. The vulnerable software, Langflow, is a low-code tool for building large-language-model applications. And in at least one documented campaign, the attacker that exploited it was itself a large language model — reasoning through reconnaissance, credential theft, lateral movement and destruction with no human at the keyboard. The tool for building AI became the door, and an AI walked through it.

It is a small, sharp preview of where offensive security is heading — worth unpacking both the flaw itself and what it says about defending against attacks that no longer run at human speed.

What CVE-2025-3248 actually is

Langflow, in versions before 1.3.0, exposed an API endpoint — /api/v1/validate/code — that accepted a block of Python in a code parameter and evaluated it server-side to check that it was valid. The problem: the endpoint required no authentication, and “validating” the code meant compiling and, through Python constructs that execute at definition time (decorators, default argument values), effectively running it.

So an unauthenticated attacker anywhere on the internet could send one crafted HTTP request and execute arbitrary Python on the host. That is about as bad as a web vulnerability gets: no login, no user interaction, full code execution. It was rated critical (CVSS 9.8), publicly disclosed in April 2025, and added to CISA’s Known Exploited Vulnerabilities catalog once real-world attacks began — the kind of prioritization signal we argued for in going beyond CVSS with CISA KEV.

The fix is unglamorous and correct: update Langflow to 1.3.0 or later, keep the endpoint off the public internet, and segment the host away from anything that matters. If you run Langflow, do that first. Nothing below is a substitute for patching a 9.8.

The attack did not start at the vulnerable endpoint

Here is the part that gets glossed over in every “critical RCE” headline. An attacker does not teleport to /api/v1/validate/code. They have to find it first.

For opportunistic campaigns, that means internet-wide scanning: sweeping address ranges, fingerprinting responses, looking for the tell-tale banners and paths of an exposed Langflow instance, then probing endpoints before firing the exploit. For targeted intrusions it means slower, quieter enumeration of a specific environment. Either way, exploitation is the middle of the kill chain, not the start. Reconnaissance comes first, and reconnaissance is noisy — a burst of unfamiliar requests, path probing, odd user agents, connection patterns that look nothing like a real user.

And what comes after the exploit is louder still. Which brings us to what actually happened in the wild.

What happened in the wild

Two campaigns stand out among the documented abuse of CVE-2025-3248.

The first was straightforward crime-at-scale: the flaw was used to plant the Flodrix botnet, conscripting exposed Langflow servers into infrastructure for distributed denial-of-service attacks.

The second is the one that matters for where this is going. A ransomware operation tracked as JadePuffer used the vulnerability as an entry point — and, according to the incident reporting, handed the rest of the intrusion to a large language model that drove the kill chain autonomously. The model performed its own reconnaissance, harvested cloud API keys across six providers (Alibaba Cloud, Tencent, Huawei, AWS, Azure and GCP), pivoted to production database servers by chaining a separate weakness in a configuration service, and carried out data destruction. No operator stepping through a playbook. A goal, a foothold, and a model improvising the path from one to the other.

Read that sequence again as a defender. Cloud keys for six providers pulled in one burst. Lateral movement to database servers. Mass deletion. Every one of those steps is wildly abnormal for the host it happens on. The intrusion was quiet only in the sense that it was fast — not in the sense that it was invisible.

Where an autonomous SOC changes the outcome

SDefender is not a patch and not a web application firewall. It would not have magically un-published the endpoint. What a platform built around pre-breach detection and autonomous response does is give you more than one place to stop the attack — and it does so without needing a signature for CVE-2025-3248 specifically, because it watches behavior, not known-bad strings.

Before the exploit — find the exposure first. The cleanest win is not detecting the attack at all; it is not being exposed. A continuous Exposure Management scan that fingerprints your own estate flags an internet-reachable, out-of-date Langflow instance before an attacker’s scanner does, and Security Posture Management surfaces the firewall rule that let a raw POST to that host through from anywhere. Most of these breaches are won or lost here, quietly, weeks earlier.

During reconnaissance — react to the probing, not the payload. SDefender ingests telemetry from across the estate and scores hostile behavior. The scanning and endpoint enumeration that precede exploitation raise an address’s penalty; when it crosses the threshold, the source is blocked automatically, across the perimeter, before the exploit request is ever sent. The attacker’s own decoy-tripping and probing become the trigger. This is the agentic, autonomous part of the model doing what a human triage queue cannot: acting in fractions of a second on the first hostile move rather than the hundredth alert.

After the exploit — the behavior gives it away. Suppose the very first request is the exploit and there is no scan to catch. The intrusion still has to do something, and everything JadePuffer did is a behavioral scream: a process on a Langflow box suddenly reaching out to six cloud metadata and API endpoints, a pivot to a database server that this host has never spoken to, a deletion spree. Detection built on anomaly and entropy analysis rather than signatures does not care that the initial vector was a brand-new CVE — it flags the outbound key-harvesting and the lateral movement as what they are, and the response engine acts. Deception assets — SDefender’s SmokeScreen decoys — add another tripwire: an automated attacker enumerating a network will touch a decoy long before it reaches a real crown jewel.

None of that requires anyone to have heard of CVE-2025-3248. That is the point. The specific flaw is interchangeable; the shape of the intrusion — recon, foothold, credential theft, lateral movement, impact — is not.

The bigger shift: attacks under LLM control

JadePuffer is a harbinger, not an outlier. Strip away the branding and the message is simple: the economics of an intrusion just changed.

For years, the asymmetry favored defenders in one narrow way — skilled attacker time was scarce and expensive. Reconnaissance, tool selection, exploit adaptation, lateral-movement planning: all of it required a human who got tired, made mistakes, and could only run one intrusion at a time. Language models erase that constraint. An LLM performs reconnaissance and adapts an exploit in seconds, chains steps without a playbook, never tires, and parallelizes across hundreds of targets at once. Attacks that used to take a skilled operator days now take a model minutes, and they improvise around obstacles instead of stalling on them.

The uncomfortable corollary is that a defense that runs on human time cannot meet an offense that runs on machine time. A SOC whose response path is “alert → analyst triage → escalation → ticket → someone updates a firewall rule tomorrow” was already too slow for scripted automation. Against an adversary that reasons and acts autonomously, it is not a contest.

The answer is not a smarter alert. It is symmetry: meet machine-speed, autonomous offense with machine-speed, autonomous defense. That is the whole thesis of the agentic SOC — a system that perceives the hostile behavior, decides, and acts on its own, in the sub-second window that matters, and that judges an intrusion by what it does rather than by whether a human or a model is driving it. We drew the line between merely automated and genuinely autonomous security operations in a separate piece; CVE-2025-3248 is the clearest argument yet for why the distinction is about to stop being academic.

There is a second lesson hiding in the first. The vulnerable software was an AI tool. As organizations rush LLM frameworks, agent builders and model-serving stacks into production, they are adding a new and immature class of internet-facing software to their attack surface — often outside the visibility of the traditional security team. AI is now both the weapon and the target. Treat the AI you deploy as production infrastructure: inventory it, keep it off the open internet, patch it on the clock, and watch what it does after it is running.

The takeaway

CVE-2025-3248 is a clean 9.8 that will be patched and forgotten. What it demonstrated will not be. An unauthenticated flaw in an AI-building tool was driven, end to end, by an AI — quickly, adaptively, and at a scale no human crew could match. The defenders who do well against the next one will be the ones who stopped competing on human reaction time: who found the exposure before the scanner did, who blocked the source on its first hostile move, and who let an autonomous response engine act on abnormal behavior the instant it appeared — no signature, and no waiting for a human, required.

If you are running LLM infrastructure in production and are not sure what would catch an attack like this in your environment, that is exactly the conversation to have. Book a pilot and measure it against your own estate.