The race to deploy AI tools across the enterprise has never been faster — and the attack surface has never been wider. From AI coding assistants woven into developer workflows to LLM gateways routing sensitive prompts across dozens of providers, organisations are stacking AI components on top of one another at a pace that is quietly outrunning their security controls.

The proof is in the CVEs. Three of the most widely adopted AI tools — Microsoft Copilot, LiteLLM, and Langflow — have each suffered serious, real-world security incidents in the last 12 months. Together, they form a masterclass in what can go wrong and a practical roadmap for how to audit your own AI stack before it happens to you.

Why Your AI Stack Demands a New Kind of Security Audit

Traditional security tooling was built for traditional applications.

Standard application security audits miss the attack surfaces AI systems introduce: prompt injection, training data poisoning, model extraction, and data-in-prompt leakage.

Put bluntly,

a standard SOC 2 report tells you almost nothing about whether an LLM endpoint will leak your customer data when prompted adversarially.

The stakes are rising sharply.

Gartner expects that by the end of 2026, up to 40% of enterprise applications will integrate with task-optimising AI agents — a sharp rise from 2025, when less than 5% of applications integrated such technology.

More agents mean more autonomous action taken under real user identities, with real permissions, against real data.

Every enterprise will adopt AI agents. The only question is whether security teams will have the visibility and control to govern that adoption, or whether they will discover the gaps only after sensitive data has already left the environment.

Lesson 1: Copilot and the Danger of Excessive Access

Microsoft 365 Copilot is a perfect illustration of how an AI tool's greatest strength — deep integration — can become its biggest liability.

Because it integrates with all other Microsoft 365 services, Copilot has access to internal documents, emails, files, and communication logs. If this data is not properly managed or if access controls are inadequate, sensitive data can be exposed, internally and externally.

In June 2025, the risk became concrete.

The vulnerability, dubbed EchoLeak and assigned CVE-2025-32711, could have allowed hackers to mount an attack without the target user having to do anything — representing the first known zero-click attack on an AI agent.

Researchers assigned EchoLeak to a new class of vulnerabilities called 'LLM Scope Violation' — flaws that cause a large language model to leak privileged internal data without user intent or interaction. Threat actors could abuse the issue to extract sensitive data, such as chat histories, documents, or SharePoint content.

It didn't stop there.

Microsoft later assigned CVE-2026-21520, a CVSS 7.5 indirect prompt injection vulnerability, to Copilot Studio.

Microsoft's decision to assign a CVE to a prompt injection vulnerability in an agentic platform was described as "highly unusual" — and if the precedent extends to agentic systems broadly, every enterprise running agents inherits a new vulnerability class to track.

What to audit: Review every data source Copilot or your AI assistant is connected to.

Because Copilot interacts with Word, Excel, Outlook, Teams, and SharePoint, any misconfiguration in these apps can create indirect exposure paths. Cross-app dependencies often lead to complex permission chains that traditional tools fail to track.

Apply least-privilege access to AI agents and enforce strict data boundary policies.

Lesson 2: LiteLLM and the Supply Chain Blind Spot

LiteLLM is the invisible plumbing of many AI stacks — a gateway library that abstracts away differences between model providers.

LiteLLM is increasingly being deployed as a centralised LLM gateway that stores API credentials for multiple model providers. In that configuration, the credential set accessible from a single compromised host is broader than for a typical application.

That concentration of sensitive credentials made LiteLLM a prized target.

On March 24, 2026, the self-proclaimed "TeamPCP" threat actor compromised the PyPI publishing credentials for LiteLLM, a highly popular open-source library used to route requests across various LLM providers.

The malicious versions were available for approximately three hours before PyPI quarantined the package. LiteLLM is downloaded roughly 3.4 million times per day

— making even a three-hour window a serious incident.

Beyond the supply-chain attack, LiteLLM's own codebase had accumulated a troubling vulnerability record.

The GitHub Advisory Database lists 16 documented CVEs for LiteLLM across 2024, 2025, and 2026.

Three are rated Critical and five are rated High.

Among them:

a SQL injection vulnerability in the /global/spend/logs endpoint, where code built an SQL query by directly concatenating an unvalidated api_key parameter.

And

an improper API key masking flaw where the masking logic only masked the first 5 characters of API keys, allowing leakage of most of the secret key in logs.

The deeper structural lesson is clear.

AI and ML projects have exceptionally deep dependency trees — DSPy, MLflow, CrewAI, OpenHands, and dozens of frameworks pull LiteLLM as a transitive dependency.

Rapid ecosystem growth outpaces security maturity. Many AI/ML packages are maintained by small teams or solo developers, and the pressure to ship AI features drives fast adoption of poorly-audited packages.

What to audit: Run a full software composition analysis (SCA) on every library in your AI stack. Pin dependency versions, monitor PyPI and npm feeds for compromised packages, and rotate all API keys stored in LLM gateway configurations on a regular schedule.

Lesson 3: Langflow and the Risk of Unauthenticated Execution Endpoints

Langflow is the visual workflow builder that democratised the creation of LLM pipelines and AI agents. It is also a cautionary tale about what happens when security is treated as a feature to add later rather than a foundation to build on.

CVE-2025-3248, a critical remote code execution vulnerability with a CVSS score of 9.8, was discovered in Langflow. The issue resides in the platform's /api/v1/validate/code endpoint, which improperly invokes Python's built-in exec() function on user-supplied code without authentication or sandboxing — allowing attackers to execute arbitrary commands on the server.

The vulnerability wasn't new.

CVE-2025-3248 had a nearly two-year arc from initial discovery to final fix — an unusually long window that exposes architectural trade-offs and how Langflow's security posture evolved.

Worse, attackers didn't wait for a proof-of-concept.

Threat actors exploited a critical Langflow RCE vulnerability within 20 hours, working only from the advisory description. Given a CVSS score of 9.3, it required no credentials and only a single HTTP request. Sysdig observed threat actors exploit the CVE within a day, despite the fact that no public proof-of-concept code existed.

An active campaign exploiting CVE-2025-3248 deployed the Flodrix botnet, enabling threat actors to achieve full system compromise, initiate DDoS attacks, and potentially exfiltrate sensitive data.

What to audit: Identify every AI workflow tool or agent-building platform exposed to the internet.

Researchers noted that CVE-2025-3248 is "easily exploitable" and encouraged users to refrain from "exposing any recently developed AI tools to the Internet."

Enumerate all code-execution endpoints and ensure they require authentication and operate inside a sandboxed environment.

The Canonical AI Attack Chain — And How to Break It

These three incidents are not isolated. They map to a repeating pattern that security teams need to internalise.

The canonical agent kill-chain runs: indirect prompt injection → excessive agency → improper output handling. A poisoned document changes agent intent, the over-permissioned tool executes the action, and the unsanitised output reaches a shell or browser. Defences must break all three links.

According to OWASP's 2025 Top 10 for LLM Applications, prompt injection ranks as the #1 critical vulnerability, appearing in over 73% of production AI deployments assessed during security audits.

It is not a theoretical risk — it is the default condition of most unaudited deployments.

Practical Tips: Your AI Stack Audit Checklist

Use this checklist to act immediately, before your next deployment:

A structured audit should span 7 control domains: infrastructure, data, model, access, logging, supply chain, and governance.

Apply least privilege to every AI agent, scoping permissions to only the specific tools and data needed for each task. Require human approval for high-impact actions like database writes, financial transactions, or external communications. Log all agent actions with full context.

Scan model files, use safetensors, audit dependencies, and verify plugin integrity.

Pin versions, subscribe to security advisories for every package in your AI stack, and treat a PyPI compromise as a fire drill scenario to plan for.

The OWASP Top 10 for LLM Applications notes that neither RAG nor fine-tuning fully mitigates prompt injection; instead, it recommends defence-in-depth with least-privilege tooling, input/output filtering, human approval for high-risk actions, and regular adversarial testing.

Implement data loss prevention layers that scan and redact sensitive information from both inputs and outputs. Audit what data your AI systems can access and enforce least privilege across all integrations.

Validate and sanitise data before storing in agent memory, implement memory isolation between users and sessions, set memory expiration and size limits, and audit memory contents for sensitive data before persistence.

Most enterprises run a comprehensive audit annually, with targeted assessments at each major model change. High-risk systems may warrant quarterly control testing and continuous monitoring reviews.

Conclusion: Security Can't Be an Afterthought in Your AI Stack

The vulnerabilities in Copilot, LiteLLM, and Langflow share a common root cause: security was treated as something to bolt on after the AI capabilities were built. The result is an attack surface that traditional tools cannot see and traditional audits cannot measure.

The good news is that the frameworks, checklists, and technical controls exist right now to close these gaps. The OWASP Top 10 for LLM Applications, NIST AI RMF, and the emerging body of AI-specific CVE disclosures give security teams a concrete, evidence-based foundation to work from. All that's missing is the commitment to act before the next breach — not after.

Ready to assess your AI stack's security posture? Download our AI Security Audit Template, subscribe to our weekly threat intelligence digest for AI-specific CVEs, or contact our team for a guided AI security assessment. Don't wait for a CVE to tell you where your gaps are — find them first.