Most recent
navigate open esc close Corpus index built 2026-06-07 23:58 UTC

§ THE STACK / AGENT LAYER

Agent Frameworks

LangGraph, AutoGen, CrewAI, multi-agent orchestration

How LLMs reach out and take action: call APIs, browse the web, drive workflows.

What it is

Where MCP standardises one agent calling tools, agent frameworks orchestrate many agents talking to each other. LangGraph (LangChain) models agent flows as state machines on a graph. AutoGen (Microsoft) and its fork AG2 model multi-agent conversations with explicit role assignments. CrewAI is the high-level “Researcher / Planner / Critic / Writer” team abstraction. MetaGPT ships the same idea as a software-team simulation. Together they are how teams ship the kind of system Anthropic’s CEO calls “a virtual coworker.”

What goes wrong

The orchestrator process is a long-running stateful Python service that holds the entire conversation graph between every agent it has ever coordinated. The state typically lives on disk or in a Redis-backed checkpoint store. When the orchestrator’s HTTP control plane is exposed without auth, an attacker reads every agent’s history (which often contains intermediate tool outputs and customer data) and can frequently inject new messages into a running conversation. The attack surface is every tool every agent has ever been given multiplied by the orchestrator’s lifetime.

How we test

We probe LangGraph’s /threads and /runs endpoints, AutoGen’s WebSocket control surface, and CrewAI’s REST API for the conversation inventory. Conversation IDs and timestamps tell us how long the orchestrator has been running and how active the operator’s deployment is. We do not read message bodies. The agent role catalogue (extractable from configuration without reading conversations) is sufficient operator-attribution evidence.

Receipts

Research

Every survey, case study, and disclosure we've published that touches this layer of the stack. Counts on the cells above tally these directly.

Cross-cloud surveys

8
Survey Jun 7, 2026

LangGraph Studio Population Survey — Local Dev Tool Misdeployed to Public AWS at 90.9%

LangGraph Studio (github.com/langchain-ai/langgraph) is LangChain's local-development debugger / visualizer for LangGraph applications. It is designed to run on localhost:2024 during development, with…

Read →
Survey May 29, 2026

Auth / Identity / Gateway survey, 2026-05-29

Open Policy Agent ships with no authentication, and five of six sampled hosts returned their full Rego policy list with no credentials. The policy names are the finding. They map the operator's author…

Read →
Survey May 25, 2026

LangGraph's Deployment Gap: Exposed AI Agent Infrastructure at Scale

LangGraph's self-hosted deployment path ships with no authentication. We found sixteen internet-facing deployments. All sixteen were open. A financial AI system processing credit reports in Shanghai. A two-node PII scraper running in Paris with no auth by design.

Read →
Survey May 25, 2026

LangGraph Server Population Survey (2026-05-25)

Population-scale survey of LangGraph Server deployments. LangGraph is LangChain's stateful multi-agent execution runtime. The canonical server ships on FastAPI/uvicorn (port 8000) with no authenticati…

Read →
Survey May 17, 2026

22 unauthenticated AI-stack Elasticsearch operators (2026-05-17)

The morning's mapping probe surfaced 22 Elasticsearch hosts with densevector or knnvector fields. Those are unambiguous AI / RAG workloads. We ran cert-pivot, Shodan, and aimap-profile on each one.

Read →
Survey May 17, 2026

AI agent framework population survey, 2026-05-17

We surveyed the public-facing agent-framework population: AutoGen Studio, CrewAI, LangGraph Studio, Langflow, AgentOps. The corpus harvested from Shodan dorks totaled 351 unique IPs. After running aim…

Read →
Survey May 16, 2026

Agent-Framework Stragglers Population Survey (2026-05-16)

Population survey of the agent-framework stragglers. Platforms that emerged in 2024-2025 alongside the AutoGen / Open WebUI / Flowise generation. Closes the gap left by the AutoGen Studio survey (2026…

Read →
Survey May 14, 2026

AutoGen Studio, agent-platform tier cloud survey 2026-05-14

NuClide Research

Read →

Field cases

23
Case May 31, 2026

Dark-Tier Probe Result (Option A) — 2026-05-31

<!-- ksat-tag:auto-generated:start --> ## DCWF KSAT coverage

Read →
Case May 28, 2026

Sanio AI — Collision AgentOS / Walmart Pipeline Exposure

Surface identified in session 43 (cat-06 stragglers survey) via Shodan dork port:7777 http.html:"agno". Prior session confirmed the host as unauth Agno on port 7777 with road collision data in scope.…

Read →
Case May 26, 2026

Cat-06 Stragglers: Agno Auth-Off-Default, GPT Researcher 14 Unauth, Walmart Temporal Exposure

Agno ships with no authentication. The playground server (uvicorn, port 7777) returns full agent manifests and run histories to any caller. Three confirmed Agno deployments expose AI agents with live…

Read →
Case May 25, 2026

Airbnb Tenant Agent — CORS Wildcard and Open Booking Thread State

A LangGraph-backed Airbnb booking agent on Hetzner Nuremberg exposes thread creation, thread state reads, and agent execution with no authentication. CORS wildcard headers mean any browser origin can invoke the agent. WhatsApp guest communications are the data class at risk.

Read →
Case May 25, 2026

Airbnb Tenant Agent — CORS Wildcard and No Auth on a Live WhatsApp Booking Bot

An Airbnb property manager's WhatsApp booking bot runs on LangGraph with no authentication and a wildcard CORS policy. Thread state from real guest conversations is readable without credentials. The agent is named 'Airbnb Tenant Agent' and is active.

Read →
Case May 25, 2026

Airbnb Tenant Agent — CORS Wildcard on a WhatsApp Booking Assistant

An Airbnb property host's WhatsApp booking assistant runs LangGraph with CORS Access-Control-Allow-Origin: * and no authentication on any endpoint. Any webpage can create threads and read guest booking conversations. The WhatsApp webhook service runs on the same host.

Read →
Case May 25, 2026

ArtsyPetz CrewAI Stack: Langfuse LLM Observability Open Registration, Multi-Service Stack Exposed

A multi-service AI stack at 147.182.219.125 exposes Langfuse 3.88.1 LLM observability with open self-registration. ClickHouse 25.7.1.3997, GlitchTip, and MinIO run on the same host with auth enforced. A CrewAI social content generation service is present on ports 8001 and 9002. The operator is an indie developer running ArtsyPetz (pet portrait e-commerce) alongside a social media growth tool in development.

Read →
Case May 25, 2026

Assistent Tècnic Intel·ligent (ATI) — Vite Dev Server in Production, 211-Tenant Platform

A Catalan multi-tenant AI customer support platform runs a Vite development server in production on one of three Hetzner nodes, exposing full TypeScript source code. All three nodes share unauthenticated LangGraph agent endpoints and Qdrant databases holding 121 customer conversations and 377 tenant knowledge-base documents.

Read →
Case May 25, 2026

Collector Scraper API — AI-Powered PII Extraction Service, Unauthenticated

Two Scaleway nodes in Paris run an unauthenticated API built to extract emails, phone numbers, and coordinates from business directory listings. No authentication on the extraction endpoint.

Read →
Case May 25, 2026

CrewAI SOP RAG Agent: Multi-Agent Standard Operating Procedure System Open Without Authentication

A multi-agent CrewAI system on Azure exposes its full API without authentication. All nine endpoints are open. POST /upload allows unauthenticated file ingestion into the SOP database. POST /query runs the full agent pipeline against stored documents. The agent roster and workflow configuration are enumerable without credentials.

Read →
Case May 25, 2026

Docu Companion / ATI — Vite Dev Server and 211 Tenant Knowledge Bases Open on a Three-Node Hetzner Cluster

A Catalan-language multi-tenant AI customer support platform runs a Vite development server in production on one node, exposing full TypeScript source. All three Hetzner nodes share an unauthenticated Qdrant stack holding 211 tenant knowledge bases, 377 business documents, and 121 user conversations. Agent invocation endpoints are fully open.

Read →
Case May 25, 2026

Assistent Tècnic Intel·ligent — Vite Dev Server in Production Exposes Source Code Across a 211-Tenant Platform

A Catalan AI document platform running across three Hetzner nodes exposes its full TypeScript source code via a Vite development server left running in production. All agent endpoints, 121 user conversations, and 211 tenant knowledge bases are accessible without authentication.

Read →
Case May 25, 2026

Chinese Financial LangGraph Agent — Credit Reports, Loans, and an Open Session Store

A Chinese financial services multi-agent system on LangGraph runs credit report and loan extraction workflows in development mode with no authentication. The agent session store is accessible via Redis Commander on port 8081.

Read →
Case May 25, 2026

NextHello CrewAI CRM: 59-Endpoint Operational API Open Without Authentication, Live API Keys

A CrewAI-based WhatsApp CRM platform at 132.145.158.151 exposes 59 endpoints without authentication. All operational POST endpoints accept requests without credentials. People Data Labs, HeyGen, and ElevenLabs API keys are live. A WhatsApp bridge with persisted session credentials is disconnected; reconnect enables message delivery to any phone number. The admin data layer is gated.

Read →
Case May 25, 2026

Stock.ai (EMOR AI) — Partial-Auth Failure, Open Vector Store, and Third-Party Research Leak

An Indian fintech startup's LangGraph stock analysis app authenticates the list layer but leaves individual resource endpoints wide open. 62 proprietary Arihant Capital analyst reports are accessible without auth through a co-deployed Weaviate instance.

Read →
Case May 25, 2026

Stock.ai — Partial-Auth Failure Exposes 62 Arihant Capital Reports and User Data

An Indian fintech startup's stock research assistant exposes 62 proprietary Arihant Capital analyst reports and user conversation history. The developer built JWT authentication and left the individual resource endpoints unprotected.

Read →
Case May 25, 2026

Vantage Coach — Healthcare CRM Agent With Voice Endpoints, No Auth

A pharmaceutical sales rep AI assistant runs LangGraph on two DigitalOcean nodes with no authentication. The agent has declared access to a healthcare client database. Voice endpoints accept unauthenticated audio and return agent-processed responses. Client records including doctor names, specializations, visit history, and treatment discussion notes are accessible to any caller with a valid organization ID.

Read →
Case May 25, 2026

Vantage Coach — Pharmaceutical CRM with Healthcare Client Records and Voice Endpoints Open

A pharmaceutical sales representative AI tool on two DigitalOcean nodes exposes a healthcare client database, conversation history, and voice endpoints without authentication. The OpenAPI spec explicitly describes access to doctor names, hospitals, visit dates, and medication discussion records.

Read →
Case May 25, 2026

Vantage Coach — Pharma CRM Agent, Open Voice Endpoints, Healthcare Client Records

A Spanish-language pharmaceutical CRM AI agent runs on two DigitalOcean nodes with no authentication. The agent has tool access to a healthcare client database. Voice endpoints accept audio queries against that database without credentials.

Read →
Case May 25, 2026

wuji Sleep Doctor — WeChat Health Data and 9,244 Request Logs Exposed on Tencent Cloud

A Chinese sleep health application on Tencent Cloud exposes per-user sleep sensor data by WeChat openid and serves 9,244 logged API requests without authentication. The service runs as root with log file paths disclosed.

Read →
Case May 25, 2026

Chinese Sleep Doctor App — WeChat Health Data Open by Design, 9,244 Request Logs Exposed

A Chinese WeChat Mini Program backend for sleep health diagnostics runs on TencentCloud Beijing with no authentication. Sleep sensor data is accessible by WeChat openid. 9,244 request logs containing user identifiers, health responses, and client IPs are readable without credentials.

Read →
Case May 25, 2026

wuji Sleep Doctor — Chinese Health Data by WeChat OpenID, 9,244 Request Logs Open

A Chinese sleep health WeChat Mini Program backend runs a LangGraph Sleep Doctor service with no authentication on any endpoint. Sleep sensor data (AHI, heart rate, HRV, sleep stages) is accessible by WeChat openid alone. A 36.9MB request log containing 9,244 entries — including user identifiers, request bodies, response bodies, and client IPs — is served at /api/monitor/logs without auth. The service runs as root.

Read →
Case May 16, 2026

Hospital's AI chatbot exposes 270,000+ patient records

A multi-tenant Chinese hospital AI assistant is running on a single Chinese-cloud-hosted IP with every layer of its AI stack reachable from the public internet without authentication. The chatbot's RA…

Read →