These items are required to enable basic website functionality. These items are used to deliver advertising that is more relevant to you and your interests. These items help the website operator understand how its website performs, how visitors interact with the site, and whether there may be technical issues. These items allow the website to remember choices you make (such as your user name, language, or the region you are in) and provide enhanced, more personal features. I uncovered 14 critical and high severity vulnerabilities, including multiple unauthenticated prompt-injection to RCE chains, across seven AI orchestration platforms. This research was presented at DEFCON 34. ‍ NocoBase,Flowise,Langflow,Dify,Activepieces,Kestra, andApache Airflowhave quietly become critical infrastructure as a result of the agentic AI buildout. They’re used by individuals and enterprises alike to hack personal productivity, build agents, and automate workflows. Langflow and Dify each carry more than 150,000 GitHub stars each, among the most-starred projects in the AI ecosystem. Even the smallest platform in this study, Activepieces, has more than 23,000 GitHub stars. All seven have become critical infrastructure for developers building AI agents and workflows, but they also all All share the same dangerous assumption: "Anyone who can touch a workflow is trusted to run code on the host." I went hunting across those seven platforms and walked out withfourteen critical and high vulnerabilities and multiple public CVEs/GHSAs (7 and growing). I collected an arsenal of vulnerabilities and primitives: shell injection, executing user supplied code on validation, prompt injecting LLMs to remote code execution, sandbox bypasses, and unauthenticated APIs that execute code. The most serious chain needs almost no setup. An unauthenticated user can trigger a prompt injection, executing code and allowing them to exiltrate data, all without ever creating an account or credentials on the platform. With some configurations, Flowise, Kestra, and Langflow could all be exploited without an attacker ever signing in. Some vendors closed the reports as working-as-designed, on the argument that executing code is the product and hardening the deployment is the developer's problem. That argument holds up until you notice the necessary defenses are either not present or any internet user can execute the code. Every vulnerability is a variation on the same error. These are multi-tenant code-execution environments, shipped as single-user developer tools, and the threat model has not expanded alongside the products. As a result, individuals and enterprises building agents with these platforms inherent the permissive threat models they ship by design. These vulnerabilities provide access to sensitive information meant to provide context to AI agents—credentials and access to personal email and calendars for individuals, or customer data for enterprises. Any connector implemented should be treated as a point of compromise. I presented this research at DEF CON 34 and have published the full technicalwhitepaper here. I’ve summarized some of the technical findings below. The findings from my research sit on a spectrum: On the accidental end, NocoBase built three defenses around its expression evaluator: a SES Compartment, a string preprocessor, and a Proxy guard. All three had holes. Thelockdown()call that arms SES was commented out with aTODO. The Proxy'shas()trap returnstruefor a TypeScriptprivatefield, because private is a compile-time fiction that compiles to an ordinary instance property. Every authenticated user could reach the sandbox through an ACL that readloggedIn. One request escalated a member account toCOPY … TO PROGRAMon the database host. CVSS 9.9, no malice anywhere. Velocity outran review. Further right, Flowise and Langflow trusted LLM output as executable code. It reduces to one simple equation: LLM output equals user input