According to CoinMeta, the 12th exploit of Langflow triggered continuous credential theft activities due to the CVE vulnerability. Based on monitoring by Vulncheck, the Langflow framework, which is identified as AI, was significantly exploited in 2026. On August 30, more than 50 warnings were detected, and by September 1, the total number of detections exceeded 360. This activity was mainly focused on CVE-2026-0768, an unauthenticated remote code execution vulnerability with a CVSS rating of 9.8. In 2026, a total of 12 different CVE vulnerabilities were exploited, including 11 new ones. Researchers recorded over 15,000 successful exploitation attempts. This framework still remains a primary target for automated attacks, with over 153,000 star ratings on GitHub. Geographical analysis shows that the United States is the main area affected by these vulnerabilities, with high concentrations also found in Germany, Malaysia, Brazil, and India. Attackers utilized this global footprint to carry out two main operations: credential theft and crypto-mining.