LangChain core serialization flaw exposes agent framework trust boundaries

At a glance

What this is: This is a vulnerability analysis of a critical langchain-core serialization flaw that can turn attacker-shaped data into unsafe object instantiation and secret exposure in common agent workflows.

Why it matters: IAM, PAM, and AI governance teams need to treat framework serialization paths as trust boundaries because untrusted model output can cross into privileged state, secrets, and execution-adjacent behavior.

By the numbers:

• LangChain has ~847M total downloads and about 98M downloads in the last month, according to public package telemetry cited by CYATA.
• The vulnerability advisory identified 12 distinct vulnerable flows, including streaming, logging, message history, and caches, according to CYATA.

Context

LangChain core serialization is the boundary that turns internal objects into structured data and then back again. In this case, that boundary failed because attacker-shaped dictionaries could carry a reserved lc marker through ordinary framework paths, which is the sort of trust failure that matters to identity and access teams as much as it does to application developers.

The practical risk is not limited to a single explicit load() call. The article describes common framework features such as streaming events, logging, message history, memory, and caches as viable paths for untrusted LLM output to influence serialized state and later be rehydrated into privileged behavior.

For identity practitioners, the lesson is that agent frameworks now have trust boundaries comparable to NHI and delegated access systems. If a framework can treat user-influenced content as internal structure, then the control plane around secrets, object revival, and execution permissions needs governance at the same level as any other privileged identity path.

Key questions

Q: What breaks when a framework treats attacker-shaped data as trusted structure?

A: The trust boundary collapses, and attacker-controlled fields can be reinterpreted as internal objects or privileged state. In agent frameworks, that can turn ordinary serialization into secret exposure, object instantiation, or other side effects. The control failure is not just parsing, but the assumption that serialized content is already safe to rehydrate.

Q: Why do serialized agent workflows create more risk than direct deserialization alone?

A: Because the dangerous state can move through normal features such as streaming, logging, memory, and caches before it is rehydrated. That widens the attack surface and makes the issue systemic rather than endpoint-specific. Teams need to govern every persistence and replay path, not only explicit load functions.

Q: What do security teams get wrong about allowlisted object instantiation?

A: They often assume an allowlist makes deserialization safe by default. In practice, an allowlisted class can still do harmful work in its constructor, including network access or file operations. The better test is not whether a class is permitted, but whether its instantiation remains harmless when its arguments are attacker-influenced.

Q: How should teams govern secret access inside AI framework serialization paths?

A: Secrets should not be resolved from environment variables or other privileged sources during deserialization unless the input is already fully trusted. If untrusted model output can influence the serialized object, secret access becomes part of the attack surface. Governance should block that path rather than rely on later detection.

Technical breakdown

Reserved lc markers and object revival

LangChain uses a structured serialization format where dictionaries containing an lc marker identify framework objects rather than arbitrary user data. The flaw described by CYATA was that dumps() and dumpd() did not properly escape user-controlled dictionaries that happened to contain that reserved key. That let attacker-shaped data survive serialization in a form that the loader could later interpret as a framework object. In practice, this is a marker-confusion problem: the system confuses attacker-controlled structure with trusted internal metadata. Once that happens, object revival becomes a security boundary rather than a convenience feature.

Practical implication: Treat any reserved serialization marker as a boundary object, not a harmless implementation detail.

Why streaming logs and caches expanded the blast radius

The article says the vulnerable flows were not obscure edge cases. They included normal paths such as event streaming, logs, message history, in-memory state, and caches, all of which can persist or replay framework state. That matters because many AI applications do not deserialize only at the edge; they serialize intermediate state and later rehydrate it as part of ordinary orchestration. If attacker-shaped content can enter those pathways through prompt injection or tool output, the security problem is no longer one call site but a system-wide state handling issue.

Practical implication: Review every place where framework state is persisted, replayed, or rehydrated, not only explicit deserialization endpoints.

Secret resolution and unsafe allowlisted constructors

CYATA describes two especially risky outcomes: secret extraction from environment variables when secrets_from_env was enabled, and unsafe object instantiation within allowlisted namespaces. The allowlist limited which classes could be created, but some of those classes still performed useful work during construction, including network access and other side effects. That is a classic pattern in insecure deserialization: the problem is not only arbitrary class loading, but also the behavior of supposedly safe classes when attacker-controlled arguments are passed into their constructors.

Practical implication: Audit allowlists for constructors with side effects and remove any path that resolves secrets from untrusted serialized input.

Threat narrative

Attacker objective: Use serialized framework state to exfiltrate secrets or trigger unsafe object behavior inside production LangChain workflows.

1. Entry occurred when attacker-shaped LLM output or user-controlled dictionaries reached framework fields such as additional_kwargs or response_metadata through normal orchestration paths.
2. Credential or secret access emerged when deserialization was allowed to resolve secret values from environment variables during object reconstruction.
3. Escalation followed when reserved lc markers caused the framework to instantiate allowlisted objects with attacker-influenced parameters, creating side effects and possible execution-adjacent behavior.
4. Impact was secret exposure, unsafe object creation, and in some conditions potential code execution or blind SSRF-driven exfiltration.

Breaches seen in the wild

• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
• JADEPUFFER agentic ransomware 2026: The first documented agentic ransomware used harvested keys, default MinIO credentials and a default Nacos signing key to wipe a database.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent frameworks now inherit identity-like trust boundaries: CYATA’s analysis shows that serialization in LangChain core was not just a data-handling mechanism; it was a privilege boundary between untrusted model output and trusted framework state. When that boundary fails, the system begins to treat attacker-shaped content as if it were an authenticated internal object. Practitioners should stop thinking about agent frameworks as neutral plumbing and start treating them as governed execution surfaces.

Structured state is only safe when the trust boundary is explicit: The flaw worked because reserved markers and later deserialization created a path from attacker-controlled dictionaries into framework object instantiation. That is not a simple parsing bug, it is a governance failure over which data may acquire internal meaning. The practical implication is that serialization formats used by agents need the same scrutiny as any privileged access path.

Secret resolution from environment variables is a boundary-crossing assumption, not a convenience feature: Allowing untrusted serialized content to resolve secrets_from_env assumes the input already belongs inside the trust domain. CYATA’s report shows that assumption fails when the input can be shaped by prompt injection or external tools. The implication is that secret access, not just token storage, must be treated as part of identity governance for AI systems.

Marker-based object revival creates a reusable attack pattern across AI stacks: The vulnerable shape is not unique to one framework. Any system that uses reserved metadata to reconstruct objects from data can collapse when attacker-controlled fields are allowed to mimic internal structure. Practitioners should evaluate framework boundaries for object revival risk, not just individual CVEs.

Runtime controls need to move closer to issuance and serialization time: The vulnerability shows why post-hoc review is too late when the dangerous state is created and replayed automatically. If serialized state can become privileged behavior, governance has to inspect what is allowed to enter the persistence layer in the first place. That shifts the control point from reaction to issuance, which is where it belongs for agentic systems.

From our research library:

• 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

Identity governance for agent frameworks now has to account for replayed state: once model output can be serialized, cached, and later rehydrated, the trust decision is no longer made once at input time. That means framework boundaries need to be reviewed like privilege boundaries, not just like application state transitions.

Secret sprawl becomes more dangerous when it is reachable through deserialization: if environment-backed secrets can be resolved during object revival, the exposure is not limited to one bug. It becomes a governance problem across every path where untrusted content can influence runtime state, which is why serialization controls and secrets policy need to be aligned.

For practitioners

• Patch vulnerable LangChain core versions immediately Move production systems to patched versions 1.2.5 or 0.3.81 and verify the installed langchain-core version in every runtime, worker, and image. Do not assume the top-level package version tells you what is actually deployed.
• Treat framework state as untrusted until rehydration is proven safe Review additional_kwargs, response_metadata, message history, cache entries, and streamed events as attacker-shaped input if they can be influenced by LLM output, prompt injection, or external tools.
• Disable secret resolution from untrusted serialized content Remove or tightly constrain any path that resolves environment-backed secrets during deserialization, especially where serialized objects can be supplied or influenced by users or agents.
• Audit allowlisted constructors for side effects Check every class that can be revived through framework allowlists and remove constructors that perform network calls, file operations, or other side effects when instantiated from serialized data.

Key takeaways

• The article shows how a reserved serialization marker can let attacker-shaped data cross from untrusted output into trusted framework objects.
• The risk is amplified by common agent workflows such as streaming, logging, memory, and caches, which make the vulnerable path easy to reach.
• The control lesson is to treat serialization, object revival, and secret resolution as governed trust boundaries rather than implementation details.

Key terms

• Serialized Trust Boundary: A serialized trust boundary is the point where data stops being inert input and starts being treated as trusted internal structure. In AI systems, that boundary is critical because rehydrated objects can inherit privileges, side effects, or secret access that the original input never should have had.
• Object Revival: Object revival is the process of reconstructing a live object from serialized data. In secure systems, it must be tightly controlled because the reconstructed object may execute constructors, call external services, or expose privileged behaviors if attacker-influenced data is allowed into the process.
• Secret Resolution During Deserialization: Secret resolution during deserialization occurs when a loader fetches credentials or environment-backed values while rebuilding an object. That pattern is risky because untrusted input can trigger access to sensitive material before any later authorization or review step has a chance to intervene.
• Marker Confusion: Marker confusion happens when attacker-controlled data mimics an internal tag or flag that the system uses to identify trusted objects. In agent frameworks, that confusion can turn ordinary dictionaries into privileged structures and collapse the separation between user input and internal state.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.