rules-langchain

AgentExecutor with a high iteration limit and no human-in-the-loop checkpoint can execute many tool calls autonomously, amplifying the impact of a prompt-injection attack. Set max_iterations <= 10 and consider adding a confirmation step for destructive tools.

eval()/exec() inside a LangChain tool function executes LLM-generated code without sandboxing. An adversarial prompt can achieve arbitrary code execution. Implement tools with explicit, validated logic instead.

Hardcoded API key in LangChain application. Keys embedded in source are exfiltrated via repo access or logs. Use environment variables: os.environ['OPENAI_API_KEY'] or pass via SecretStr.

PythonREPLTool executes arbitrary Python code generated by the LLM, including os.system, subprocess, file writes, and network requests. This is a direct sandbox escape. Use a restricted execution environment (RestrictedPython, subprocess with allowlist, or a sandboxed container).

LangChain ShellTool/BashProcess executes arbitrary OS commands derived from LLM output. An injected prompt can exfiltrate files, install backdoors, or destroy data. Replace with scoped tools that only perform specific, validated operations.

User-controlled input interpolated into the system prompt enables prompt injection — an attacker can override instructions. Keep system prompts static; pass user data only via HumanMessage or dedicated input variables with validated types.