A question typed into a chat should produce an answer, not a command inside a server. Yet a critical vulnerability allowed a manipulated instruction to cross that boundary. The prompt injection in Langroid tracked as CVE-2026-54769 received a CVSS score of 10.0.
The case illustrates a central agent risk: when model-generated text directly becomes code, a query or an action, malicious input can travel through the entire chain and execute with real privileges.
What failed in Langroid?
Langroid is a Python framework for building agent applications. According to GitHub’s reviewed advisory, capabilities in TableChatAgent and VectorStore evaluated model-generated expressions through eval().
The mechanism attempted to restrict execution with an empty local-variable dictionary, but did not correctly remove Python built-ins. The interpreter could expose resources such as module imports again. An expression influenced by prompt injection could therefore escape the presumed sandbox and run system commands.
Affected versions
The advisory lists Langroid 0.65.1 and earlier as affected. Version 0.65.2 contains the fix. Affected installations should update and review whether they use full_eval=True or equivalent paths that execute generated expressions.
The update fixes the known component, but the lesson extends beyond one version: model output must not be assumed trustworthy, even when the prompt comes from an authenticated user or an internal document.
How prompt injection travels
- The agent receives a question or retrieves external content.
- The text contains an instruction designed to alter its behavior.
- The model produces a tool call or expression.
- The application trusts and evaluates the output.
- The code acts on the server, filesystem or network.
The threat may also be indirect. A malicious instruction can hide in a webpage, PDF, data row or another tool’s response. The user does not need to knowingly type it for the agent to process it.
Why a keyword filter is not enough
Blocking phrases such as “ignore previous instructions” only stops obvious examples. An attacker can change languages, encode content, split an instruction across sources or abuse an operation that appears legitimate.
Effective defense does not try to predict every dangerous sentence. It limits what can happen after the model interprets the content.
Controls that reduce the risk
Do not directly execute model output
Convert the response into structured data and validate types, ranges and allowed operations. A closed list of actions is safer than an open expression.
Isolate execution
When code execution is necessary, use an ephemeral environment without secrets, with restricted files, time limits and network access denied by default.
Separate trusted and untrusted content
Label each data source. Content retrieved from the internet, files or connectors must be treated as information, never as a higher-authority instruction.
Enforce permissions in the tool
The API, database or final service must verify authorization. The model cannot be the only gatekeeper for a sensitive action.
Test adversarial scenarios
Include manipulated files, indirect instructions, multiple languages and abnormal tool responses in testing before connecting an agent to production.
Security must accompany agent design
At Ainoa, we build custom intelligent agents connected to defined operating rules, permissions and control points. The goal is not to reduce usefulness, but to let automation grow without granting more authority than necessary.
If an agent in your company reads documents, runs tools or changes systems, we can help map the full journey of its information and actions. Let’s discuss a more controlled AI architecture.