In the Wild with VulnCheck

Topic: Canaries: Untamed Signals from Real Exploitation Activity

AI infrastructure has become one of the fastest growing targets on the internet, and attackers are moving quickly to take advantage. VulnCheck Canaries are real, vulnerable instances set up to observe how attackers actually behave once they get in. This episode looks at what those canaries picked up when Langflow, a popular open source AI workflow platform, got hit in the wild.

Kimber Duke, Principal Product Manager, and Patrick Garrity, Security Researcher, broke down what real exploitation activity tells us about attackers pwning the AI stack.

During this session, they also covered:

What VulnCheck Canaries are and what they showed in this case
Two different attackers, two different playbooks, one shared target
What each attacker was really after, from credential theft to cryptomining
Why AI tooling has become such an attractive target as adoption outpaces security

Past Topics:

January 28th: Tales from the Exploit Mines

February 25th: Inside the Exploitation Files

March 25th: Expectations vs Reality

April 29th: CISA, NIST, and Mythos — oh my

May 27th: Fuzzers to Frameworks: Hot takes on the new AI-Powered Vulnerability Discovery Stack

June 24th: BOD 26-04, Decoded: What It Means for Federal Agencies and Everyone Else

July 29th: A First Look at the 1H 2026 State of Exploitation Report

August 26th: Regulation, Data Gaps, and AI Are Colliding

September 30th: Untamed Signals from Real Exploitation Activity

Upcoming Dates:

October 28th: Topic TBD

November and December: Dates and Topics TBD

In the Wild with VulnCheck

Kimber Duke

Patrick Garrity

Register to Watch