grep -rl "ai-tooling" ./articles
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.
VulnCheck counted 12 Langflow CVEs with confirmed exploitation in 2026 and 15,000-plus successful attempts across three of them. On its canaries, one attacker was after credentials and another was mining Monero — on the same box, in overlapping weeks.
Two poisoned releases in March, published with a token stolen in the Trivy breach and kept alive by an incomplete rotation. CloudSEK's dataset of 434,000 captured files now maps possible exposure across 2,500+ organisations.