endorlabs.compaper

How AI orchestration platforms ship RCE by design | Ebook/Report | Endor Labs

Endor Labs research audits seven AI orchestration and workflow-automation platforms — NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow — across four languages, documenting fourteen findings that range from an accidental sandbox escape to remote code execution that is architecturally built in. The core argument is that these tools inherited a single-user developer-tool trust model (anyone who can touch a workflow is trusted to run code on the host) while being deployed as multi-tenant HTTP services with webhooks and credentials to cloud, databases, and internal APIs, so the threat model never caught up to how they're actually run in CI/CD and agentic AI stacks.