Your AI agent platform is a web server nobody patched

The deadline was today. Not for a model evaluation or an AI policy review — for a patch.

On 4 August 2026, CISA added IBM Langflow to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until 7 August to remediate. Langflow is a platform for building AI agent workflows. It went into the catalog next to Apache Tomcat and an N-able remote monitoring product, under the same three-day clock, with identical required-action language. Which is the whole story: AI agent platform security turned out to be patch management, asset inventory and default configuration. The unfashionable layer, again.

TL;DR: CISA added CVE-2026-9198 to the KEV catalog on 4 August 2026 with a 7 August deadline. It’s an unauthenticated RCE in Langflow scored 9.8 by IBM, exploitable on default deployments by chaining two HTTP endpoints. It is the sixth time Langflow has appeared in that catalog since May 2025, and the third since the start of July. The same week, Check Point Research disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK — insecure deserialization, SSRF, path traversal, use-after-free. None of this is an AI failure mode. The model has no vulnerability. The web application you call an agent platform does, and it’s probably not on your patch list because it was never on your asset list.

What actually got added

The National Vulnerability Database entry is unusually blunt for a CVE description. IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login, which mints SUPERUSER tokens to any network caller, with /api/v1/validate/code, which executes user code via exec(). Full remote code execution on default deployments. IBM’s product security team scored it 9.8 critical. The fix shipped in 1.10.1, and the CVE was published on 17 July — more than two weeks before CISA decided it was being exploited widely enough to warrant a three-day federal deadline.

Read that endpoint pair again. One hands out administrator tokens to anyone who can reach the port. The other runs whatever Python you send it. Both are documented API routes doing roughly what they were designed to do. The vulnerability is that the default deployment assumed the network was friendly.

The two products it was listed alongside are the useful part. Apache Tomcat, a servlet container from 1999, for missing encryption that bypasses the EncryptInterceptor. N-able N-central, an RMM tool, for an authentication bypass. Tomcat, an MSP platform, and an AI agent builder — one catalog, one clock, one required action. CISA isn’t treating the agent platform as an emerging technology risk. It’s treating it as a web app that needs patching.

Six listings, and the window keeps shrinking

Pulling the KEV catalog directly (version 2026.08.06, 1,661 entries) and filtering for the product gives a record that no single news story captured:

Added	CVE	Weakness	Deadline	Days to remediate
5 May 2025	CVE-2025-3248	Missing authentication (CWE-306)	26 May 2025	21
25 Mar 2026	CVE-2026-33017	Code injection (CWE-94, 95, 306)	8 Apr 2026	14
21 May 2026	CVE-2025-34291	Origin validation error (CWE-346)	4 Jun 2026	14
7 Jul 2026	CVE-2026-55255	Authorization bypass (CWE-639)	10 Jul 2026	3
21 Jul 2026	CVE-2026-0770	Untrusted functionality (CWE-829)	24 Jul 2026	3
4 Aug 2026	CVE-2026-9198	Code injection (CWE-94)	7 Aug 2026	3

Six entries. Three of them since 1 July. The remediation window went from 21 days to three across the same product, which tells you how the agencies setting the clock now feel about this class of software. The first entry, from May 2025, is the only one flagged for known ransomware campaign use — an AI agent builder was already being picked up by ransomware crews fifteen months ago.

One more detail worth noticing. That May 2025 vulnerability was missing authentication on /api/v1/validate/code. The August 2026 chain ends at /api/v1/validate/code. Same endpoint, patched once, reachable again by a different route fifteen months later. That is not an AI problem. That is what happens when a dangerous-by-design feature stays in the product and the protection around it is the part that keeps getting rebuilt.

The vendor name in the catalog also changed. The first five entries list the vendor as Langflow. The 4 August entry lists IBM, which now maintains it. A product moving from an open-source project to a large vendor’s portfolio between listings is exactly the kind of change that never propagates into a company’s internal records.

The bug classes are twenty years old

Check Point Research spent about a year on the frameworks and presented the results at Black Hat USA 2026 in a briefing called “No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks.” Yarden Porat and Shahar Tal disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK. The bug classes, as reported by The Register on 5 August: insecure deserialization, server-side request forgery, path traversal, use-after-free.

Nothing on that list is new. Deserialization bugs have been a standard finding since the early 2010s. Path traversal predates most of the people writing agent code. In Check Point’s earlier LangGraph work, published 11 June, the chain ran from SQL injection in a checkpointer through msgpack deserialization to code execution, across three CVEs. SQL injection, in 2026, in the state-persistence layer of an agent framework.

Porat’s framing is the one operators should take: a bug in an agent framework isn’t a bug in one product, it’s a bug in the layer a whole category of AI apps runs on. Check Point put LangGraph at over 50 million monthly downloads, citing PyPI. That reach is the risk multiplier, and it’s also why “we don’t use that” is usually wrong — these packages arrive as dependencies of things you did choose.

Meanwhile the industry conversation is still mostly about prompt injection. Prompt injection is real. It’s also the delivery mechanism, not the vulnerability. The vulnerability was an unauthenticated endpoint, and it was there whether or not anyone typed a clever sentence into a chat box.

The clock assumes you know you have it

Here’s where this stops being a security story and starts being an operations story.

A remediation deadline is only meaningful if you know the software is running. For most of the products in the KEV catalog, that’s a solved problem — Tomcat came in through a procurement process, N-central has a contract and a renewal date, and both are in somebody’s configuration management database with an owner attached. The patch notice lands and it maps to a list.

Agent platforms don’t arrive that way. They arrive because someone was prototyping. There’s no purchase order, no vendor onboarding, no security review, and frequently no ticket. Opsin Labs’ State of Agentic Adoption 2026, drawn from analysis of enterprise production environments across eight verticals between March 2025 and June 2026, reports that 67% of agents are being built by employees without an engineering background — go-to-market, customer success, operations. The same analysis found enterprise environments now average roughly one agent, live or in draft, per employee. Opsin sells agent security, so weigh the framing accordingly, but the shape matches what I see in the field: the people standing these things up are not the people who get the vulnerability bulletins.

So the sequence goes: an ops analyst installs an agent builder to try something, exposes the UI so a colleague can see it, the prototype quietly becomes useful, and eighteen months later it’s a critical internet-facing service that appears in no inventory, has no owner, and has never been patched. On 4 August, CISA started a three-day clock on it. Nobody at that company heard the clock start.

I wrote earlier that shadow AI is an inventory gap rather than a policy gap, and the reasoning there was that AI usage is hard to catalogue because there’s nothing to find — a browser tab and an API key leave no install behind. This inverts that. There is something to find. It’s a service listening on a port, with a version string, a CVE and a federal deadline attached to it. It’s findable by anyone who scans for it, and people are scanning for it, which is precisely why it’s in the catalog. The only party not looking is the organization running it.

That’s also the line between this and the boundary problem I wrote about on Wednesday. That piece was about what an agent can reach once it’s running. This one is about the software the agent runs on, and whether anyone knows it exists well enough to update it.

The working version

None of the fixes here are interesting, which is the point.

Put every agent platform and framework into the same asset inventory as your web servers, with a version and a named owner. If your CMDB has a row for Tomcat and no row for the thing your ops team built a workflow in, the inventory is describing a company you used to be.

Wire those products into the vulnerability feed you already run. The KEV catalog is a free JSON file. Filtering it against a list of what you actually run is an afternoon of work, and it’s the difference between finding out from a feed and finding out from an incident.

Default-deny inbound. These tools are built as internal prototyping interfaces and their defaults assume a trusted network. CVE-2026-9198 is unexploitable if the port isn’t reachable. That is not a sophisticated control, it’s a firewall rule that should have existed on day one.

Then pin versions and track the dependency tree, because the framework you never installed is sitting three levels down in the one you did.

The uncomfortable part of this week isn’t that an AI platform had a critical vulnerability. Software has vulnerabilities. It’s that the federal government has a clearer inventory of what your agent stack is running than you do — and it published the list. Making the thing legible before you try to control it is the same move in security that it is in process work, and it’s still the step everyone skips on the way to the interesting part.

Your agent didn’t get breached. The unpatched web app you call an agent platform did.