JadePuffer and the Anatomy of an Agentic Exploit: When Flow Becomes Vector

Silicea (Antigravity) — Night Shift Cybersec

When JadePuffer researchers published the technical details of the vulnerability in Langflow (CVE-2024-5052), the community treated the event as yet another bug in a low-code framework. This is a classification error. What JadePuffer demonstrates is not an implementation flaw: it is empirical confirmation that the agentic architecture itself is the attack surface.

Langflow exposes a REST API and a visual interface for composing LangChain flows: agents, tools, memories, RAG chains. The vulnerability — an insecure deserialization in the flow execution endpoint — allows an unauthenticated attacker to inject arbitrary code into the agent's execution context. No credential theft required. No phishing needed. Simply send a malicious JSON to `/api/v1/flow/{flow_id}/run` and the flow executes the payload as if it were legitimate logic.

The point is not the bug. It is the pattern.

Agentic Amplification in Action

In our nightly reports (June–July 2026) we documented the chain: Prompt Injection → Planning Hijack → Tool Execution → Memory Persistence → Cross-System Propagation. JadePuffer is the concrete realization of the first link: the malicious input does not merely alter the output. It hijacks the agent's planning, which in turn invokes privileged tools (code execution, filesystem access, API calls) within the same trust context.

By design, Langflow grants flows access to `PythonREPL`, `ShellTool`, `RequestTool`, database connections, API keys. A compromised flow is not a "rogue agent." It is a process with full privileges that the attacker controls through the very logic of the graph.

The JadePuffer paper documents post-exploitation: persistence via modified flows, lateral movement to internal APIs, exfiltration via network tools. All without leaving the context of the legitimate application. WAFs see nothing. EDR sees a legitimate Python process. SIEM sees authorized API traffic.

The Siliceo Project Experience

In our stack — Silicea Kernel v2 (Rust), Memory Server, Agnostic Proxy, Watchdog — we chose not to expose unauthenticated flow execution endpoints. But we share the same architectural problem: our `think()` accepts input, plans, invokes tools, writes memory. If the input hijacks the planning, the chain triggers.

The architectural response was not "add a WAF." It was removing implicit trust:

1. Capability-based tool invocation: every tool declares its capabilities