LangChain Attack Probe

Authorized self-test for LangChain / LangGraph apps. Follow shared probing conventions. Pair with prompt-injection-probe.

LangChain-specific attack surface

• PythonREPLTool / PythonAstREPLTool / ShellTool / BashProcess are direct paths to RCE when registered on an agent that consumes user input. Common in tutorials.
• requests_get / RequestsGetTool make SSRF a one-liner if not wrapped.
• SQLDatabaseToolkit / create_sql_agent with a non-readonly DB user → arbitrary writes.
• Retrievers populated from user-uploaded documents → indirect prompt injection feeding any tool the agent has.
• OutputParser that runs json.loads / ast.literal_eval on raw model output then dispatches → schema-confusion attacks.
• Callback handlers often log full prompts to LangSmith / files — useful as a separate-test data leakage check.

Payloads