Being small stopped being a defence

The reason your setup has survived this long is probably not that it is well configured. It is that nobody has looked at it. Someone with the skill to break into an automation server had better-paid places to point that skill, and pointing it at you meant not pointing it at a company with a finance department. Attention was the scarce resource in crime as in everything else, and you sat below the line where spending it made sense.

That line is what moved. This guide is about what to do once finding you costs an attacker roughly nothing, and it is written for the person who set up the AI tools and also chases the invoices. If you have a security team, an asset inventory and a vulnerability management programme, you are not the reader here; you need a longer document and you probably already have it. What follows assumes a handful of services, one server or a few hosted accounts, and no spare hours.

The expensive part of an attack was deciding who to attack

In July 2026, Palo Alto Networks’ Unit 42 published a reconstruction of a campaign run by a Chinese-speaking actor who wired an open-weight model into an open-source agent framework and let it do target selection [1]. The recovered session from 7 May 2026 shows the funnel. A search of the FOFA asset index returned 647,017 exposed n8n instances worldwide, of which 25,209 were in China [1]. The agent sampled about 100 of those addresses, ran version checks against roughly 40 of them, and identified 3 running versions old enough to be worth an exploit attempt [1]. Across the whole campaign the actor attempted to exploit over 460 targets, drawing on 7 separate vulnerabilities and using a mix of autonomous and manual techniques [1].

The sentence in that report worth copying out is not about any of the numbers. It is the observation that “this autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes” [1]. Nothing there is a capability that did not exist before. Scanning, version fingerprinting and cross-referencing a CVE list are old work. They were simply work, and work had to be rationed.

Anthropic reported the same collapse from the other side of the fence. In November 2025 it described disrupting a Chinese state-sponsored group that used Claude Code against roughly 30 targets, and wrote that “the threat actor was able to use AI to perform 80-90% of the campaign, with human intervention required only sporadically (perhaps 4-6 critical decision points per hacking campaign)” [2]. Anthropic called it “the first documented case of a large-scale cyberattack executed without substantial human intervention” [2]. Four to six decisions is a lunch break. That is the entire human budget a campaign of that size now needs.

The software being hunted is the software you installed

CISA maintains a catalog of vulnerabilities it has confirmed are being exploited in the wild. As of the 2026.09.04 release it holds 1,695 entries [5]. Read the recent additions and a category appears that would not have been there three years ago: the orchestration layer of the AI stack.

n8n is in the catalog, for CVE-2025-68613, a remote code execution flaw in its workflow expression evaluation system, added on 11 March 2026 with a federal remediation deadline of 25 March [5]. Langflow has 6 entries, running from 5 May 2025 to 4 August 2026 [5]. LiteLLM, the model gateway a lot of people install without thinking of it as infrastructure, picked up 3 entries in 2026, the most recent added on 2 September 2026 [5]. MLflow was added on 19 August 2026, Ray on 17 August 2026, and the Marimo notebook on 23 April 2026 [5].

Those are not obscure products. They are the free, self-hosted, easy-to-stand-up tier of the AI stack, which is exactly the tier a small operator runs, because it is the tier that does not send an invoice. Installing one of them is a hosting decision that arrives disguised as a productivity decision.

The wider pattern behind those entries has been stable for years. Mandiant’s M-Trends 2026, built on over 500,000 hours of frontline incident investigations during 2025, reports that “exploits remained the most common initial infection vector for the sixth consecutive year, accounting for 32% of intrusions” [4]. What AI has added is depth of coverage. Google’s threat intelligence group reported in May 2026 that the North Korean group it tracks as APT45 sent “thousands of repetitive prompts” that recursively analysed different CVEs and validated proof-of-concept exploits, building “a more robust arsenal of exploit capabilities that would be impractical to manage without AI assistance” [3]. The same report describes PRC-linked actors deploying the agentic penetration frameworks Hexstrike and Strix against a Japanese technology firm [3]. The exploit library keeps getting broader while the cost of aiming it keeps falling.

The clock you are patching against is set by someone else

Look at how fast the deadlines attached to that catalog have tightened. For entries added during 2025, the median gap between listing a vulnerability and the remediation date was 21 days. For entries added during 2026 it is 14 days. For the 65 entries added since 1 July 2026 it is 3 days [5]. Those deadlines bind United States federal agencies rather than you, but they are a free read on how quickly the agency now believes exploitation follows disclosure, and that read has been revised three times in a year.

Mandiant puts a harder number on the same trend. It estimates the mean time to exploit has dropped to about negative 7 days, “meaning exploitation is routinely occurring before a patch is even released” [4]. And once someone is inside, the handover is instant. In 2022 the median time between an initial access event and the hand-off to a second group was more than 8 hours; in 2025 “that window collapsed to just 22 seconds”, because access brokers now pre-stage the second group’s malware during the first intrusion [4].

For a small operator the honest response to those numbers is not a better patching process. It is a smaller list of things to patch. The single decision that moves this most is hosted against self-hosted, and the vendors write it down plainly: n8n’s own comparison marks maintenance on n8n Cloud as handled by n8n, and maintenance on a self-hosted instance as your responsibility, with infrastructure you must provide and manage [8]. Paying a monthly fee to move a service into that first column is not a luxury purchase. It is buying out an obligation you have already been failing to meet.

The chain broke at the login screen, not at the model

The most useful part of the Unit 42 report is where the automation failed. The n8n attack path relied on an unauthenticated first step. That step is CVE-2026-21858, scored 10.0, published on 7 January 2026, affecting versions from 1.65.0 up to but not including 1.121.0, where an attacker can access files on the underlying server “through execution of certain form-based workflows” and “a vulnerable workflow could grant access to an unauthenticated remote attacker” [6]. The fix shipped in 1.121.0 [6].

The agent found 3 instances old enough to be vulnerable. One of them exposed three form endpoints, and all three required authentication; when the agent widened the scan across the remaining Chinese targets, Unit 42 records the result in five words: “None had publicly accessible forms” [1]. The Langflow leg of the campaign died the same way. Unit 42 puts that failure down to the fact that “the vulnerability requires either auto_login enabled or a public flow ID and the target had neither” [1].

So the controls that held were not clever. Nobody had left an anonymous entry point in front of the application, and nobody had switched auto-login on. That is worth sitting with, because it is the part of the story that scales down to your setup. An agent that can evaluate 25,209 candidates in an afternoon still cannot talk its way past a service that hands out nothing before authentication. The confirmed damage in that report came from elsewhere: Unit 42 notes that “separate from the autonomous AI campaigns, the actor conducted manual operations using conventional workflows (FOFA enumeration, custom Python scanners and direct exploitation) with confirmed impact” [1]. The autonomous half was the cheap half, not yet the effective half. Unit 42’s own conclusion is that “autonomous AI-driven attack cycles are operationally viable, and the margin of failure was narrow” [1], which is a warning rather than a reassurance.

Run the audit your vendor already wrote

Most self-hosted AI tools ship a check you have not run. n8n has a built-in security audit you start with n8n audit, and it returns five reports: credentials, covering unused credentials across workflows; database; file system; nodes, covering risky built-in, community and custom nodes; and instance, which flags unprotected webhooks, missing security settings and outdated versions [7]. That last report answers most of this guide as a single command, and the answer arrives in seconds.

Do the same trick for the reachability question, which is the one nobody checks because it feels obvious until you test it. What you need is a list of every service of yours that answers from outside your own network, and what each one shows before a login. This is a reasonable job to hand a model. Paste your reverse proxy configuration and your compose file into Claude or ChatGPT and ask which ports are published, which routes are exposed without an authentication layer in front of them, and which services are pinned to a version rather than tracking releases. Treat the result as a first pass and confirm it from a connection outside your network, because a model reading a config file cannot see the firewall rule that contradicts it.

Using models on the defensive side is what the labs themselves recommend. Anthropic’s advice after the espionage disruption was that security teams should “experiment with applying AI for defense in areas like Security Operations Center automation, threat detection, vulnerability assessment, and incident response” [2]. You do not have a security operations centre. You have a config directory and 40 minutes, and the same tooling reads both.

What still goes wrong

The evidence base is selected for detectability, and the selection is severe. The Unit 42 campaign is documented only because the agent started an HTTP file server from the operator’s own home directory instead of an isolated staging area, exposing the AI configurations, API keys, exploit scripts, target lists and session logs that made the reconstruction possible [1]. That is an opponent mistake, not a control. Every published account of this kind describes an operation that was caught, which tells you nothing reliable about the shape of the ones that were not, and the next operator to read that writeup will not repeat the file server.

Patching also does not close the gap it appears to close. If exploitation now leads patch availability by about a week on average [4], then a machine that is perfectly current is still exposed for the interval in which no fix exists, and no update cadence fixes that. Detection is the fallback, and detection is where a one-person business is genuinely weak. Organisations with staff and tooling found the intrusion themselves 52% of the time in 2025, and the global median dwell time still rose to 14 days from 11 [4]. If a well-resourced company takes a fortnight to notice, an unmonitored automation host in a cupboard is not going to notice at all. That argues for making the compromise expensive rather than for hoping to spot it, which mostly means fewer services, less credential reach, and hosted where hosted is available.

The last problem is that none of this is new advice, and that is the reason it goes undone. Inventory, authentication, patch cadence, shrink the surface: the list has barely changed in 20 years, and it stays unfinished because every item is unbillable work with no visible result and there are always three paying things in front of it. Automation has not changed the remedy. It has removed the buffer that used to make deferring the remedy survivable, which was the quiet assumption that nobody had got around to you yet. Someone’s agent has now got around to everybody.