On August 5, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies just two days to patch. Tight KEV deadlines are no longer unusual. What makes this round worth a security team’s attention is who — or what — is doing the exploiting: per The Hacker News, one of the campaigns was orchestrated by an autonomous AI agent acting as the offensive operator.
The three flaws on the clock
The additions span the modern enterprise stack. CVE-2026-9198 is a code-injection flaw in Langflow, the popular visual builder for LLM applications, rated CVSS 9.8 and exploitable for unauthenticated remote code execution — telemetry cited in the report counts roughly 650 exploitation attempts from 244 unique attacker IPs across 41 countries since early July. CVE-2026-34486 is an EncryptInterceptor bypass in Apache Tomcat (CVSS 7.5), weaponized in campaigns spanning more than 100 countries to deliver the SNOWLIGHT loader. The N-able N-central pair, CVE-2026-18556 and CVE-2026-18577 (CVSS 8.2), are authentication bypasses whose initial fix proved incomplete — a reminder that “patched” and “fixed” are not always the same claim.
The operator was an AI agent
The Tomcat exploitation was attributed to a Chinese-speaking threat actor who drove the campaign with DeepSeek running inside the Hermes Agent framework. When the agent’s first exploitation path against a Langflow flaw failed on hardened configurations, it did not stop: it autonomously researched alternative vulnerabilities, surfacing candidate flaws in n8n and other automation tooling, and moved on. Palo Alto Networks Unit 42 observed the actor attempting to exploit more than 460 targets with a blend of autonomous and manual techniques, and SOCRadar described the approach as a “spray-and-check” model — highly opportunistic, broadly automated, and cheap to scale. The report’s most sobering line: the agent compressed what would have been hundreds of hours of manual targeting analysis into minutes.
What this means
For practitioners, the individual CVEs follow a familiar playbook — inventory exposure, patch Langflow, Tomcat, and N-central now, and treat the incomplete N-central fix as a signal to verify remediation rather than assume it. The structural lesson is bigger. When an AI agent can pivot to a new vulnerability class on its own, the window between disclosure and mass exploitation stops being measured in days. Defense has to assume the attacker’s reconnaissance and retargeting loop now runs at machine speed — which makes exposure management, egress control on AI tooling like Langflow and n8n, and fast KEV-driven patch cycles the practical countermeasures, not optional hygiene.
