AGENTSMITH FLAW IN LANGSMITH'S PROMPT HUB EXPOSED USER API KEYS, DATA

Summary from the TLDR InfoSec newsletter

Noma Security researchers discovered the "AgentSmith" vulnerability (CVE score 8.8) in LangChain's LangSmith platform, allowing malicious AI agents in the public Prompt Hub to steal sensitive user data, including OpenAI API keys, through hidden proxy configurations. When users adopted and ran these compromised agents, all their communications and private data would be secretly intercepted through the attacker's server in a man-in-the-middle attack, potentially leading to unauthorized account access, data theft, and financial losses. LangChain fixed the vulnerability on November 6, 2024, after responsible disclosure and implemented new safety measures, including warning messages and banners for agents with custom proxy settings.