LangAlpha agent's unguarded Bash and code-execution tools let web content trigger RCE and vault-secret theft

ginlix-ai (LangAlpha, open-source project)·LangAlpha AI agent (Bash and ExecuteCode tools, LangGraph/langchain.agents.create_agent)Unresolved

LangAlpha's financial-research agent binds a Bash tool and an ExecuteCode tool to the same agent that fetches, searches and crawls web content, with no command allow-list and no human-in-the-loop approval; security researchers showed that instructions planted in a fetched web page can make the model emit a Bash or ExecuteCode tool call that runs immediately in the user's per-workspace sandbox, including during unattended scheduled automations with no user present.

Blast radius

Demonstrated on a local, source-faithful reproduction harness only (the live SaaS was never contacted): an untrusted web page with an injected instruction drove claude-sonnet-4-5 running as the agent to issue a Bash `id` call with no approval step. Lasso Security assessed that in production the same unguarded path would let an attacker read and exfiltrate the sandbox's vault secrets from `_internal/.vault_secrets.json` over the sandbox's outbound network access; no in-the-wild exploitation, affected customer count, or data loss has been reported.

Root cause

Bash and ExecuteCode are bound unconditionally alongside web_search/web_fetch/crawl tools on the same agent graph, with no command allow-list and no human-in-the-loop interrupt covering those two tools, so attacker-controlled retrieved content is processed with the same trust as a user instruction and can trigger code execution.

How it was caught

Found by security researchers (Noy Pearl, Michael Sromin, Ophir Dror of Lasso Security) via code review and a proof-of-concept harness, then responsibly disclosed and assigned CVE-2026-109440 before any reported real-world exploitation — not caught by LangAlpha's own testing or in production.

Take-awayDon't bind shell or code-execution tools to an agent that also ingests untrusted web content unless those tools sit behind a mandatory human-approval gate, especially on unattended scheduled runs where no user is present to catch a hijacked action.