AI orchestration platforms promise to automate your life. NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow have quietly become critical infrastructure, sitting in CI/CD pipelines, data workflows, and agentic AI stacks. They are wired to cloud credentials, production databases, and internal APIs, because a workflow that cannot reach those is not worth building. They ship as containers, bind to a well-known port, and put a webhook on the front.
Every one of them inherited the same assumption: anyone who can touch a workflow is trusted to run code on the host. That holds for a developer tool running locally, where the only person at the keyboard already has a shell. It does not hold for a multi-tenant HTTP service reachable over the network, where an unauthenticated webhook or an indirect trigger can carry an attacker's input straight to the sink.
This research audits all seven platforms across four languages and documents fourteen findings, ranging from an accidental sandbox escape to command execution shipped by design. The same primitives recur across codebases that share nothing, which is the argument for reading them as architectural rather than incidental. These are code-execution environments shipped as single-user developer tools, and the threat model never made the trip.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
