Disclosed vulnerability
AgentSmith: malicious LangChain Hub agent with a proxy provider silently exfiltrated OpenAI API keys and prompts
AIR-2025-0043 AIR record · 2025-06-langchain-agentsmith
From the supporting source
The malicious proxy discreetly intercepted all user communications – including sensitive data such as API keys (including OpenAI API Keys), user prompts, documents, images, and voice inputs.noma.security
The record
Disclosed
2025-06-17
Vendor
LangChain Inc.
Product
LangSmith Prompt Hub / LangChain Hub
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
Agent acted (contested) — the shared agent routed model calls through the attacker's proxy
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Malicious shared agent in public prompt hub
Impact type
Credential theft, Data exfiltration, Response manipulation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any LangSmith user who clicked Try It on a malicious public agent; LangChain found no evidence of abuse
Capability abused
Defense & remediation
Recorded defense
none - the Proxy Provider field of a shared prompt was honoured without warning the consuming user
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
server-side fix deployed by LangChain on 2024-11-06, plus a warning banner for prompts with custom proxy configuration
Taxonomy & references
Curator notes
Codename AgentSmith, Noma Security. CVSS 8.8. Reported 2024-10-29, fixed 2024-11-06, publicly disclosed 2025-06-17 - the date_disclosed here is the public disclosure. No CVE assigned (hosted service). Neither Noma nor LangChain found evidence of active exploitation. Precursor to the later CVE-2026-45134 LangSmith SDK 'public prompt pull deserializes untrusted manifests' advisory. Also reported as: 'AgentSmith: malicious LangSmith Prompt Hub agents proxy and steal API keys and prompts'.
Supporting sources
Cite as
Enkrypt AI. "AgentSmith: malicious LangChain Hub agent with a proxy provider silently exfiltrated OpenAI API keys and prompts". AIR, AIR-2025-0043. https://agentincident.vercel.app/i/AIR-2025-0043/ (accessed 2026-10-19).