LangChain deserialization flaw exposes secrets through prompt injection

At a glance

What this is: Orca Security describes a critical LangChain deserialization flaw that can expose secrets and trigger unintended internal actions when attacker-influenced LLM output reaches vulnerable serialization code.

Why it matters: IAM, NHI, and AI workflow teams need to treat model outputs as untrusted inputs, because a deserialization boundary can turn prompt injection into credential exposure, internal logic execution, and broader application compromise.

By the numbers:

• CVE-2025-68664 carries a CVSS score of 9.3, which places it in the critical range.

Context

LangChain deserialization flaw in AI workflows is not just an application bug. It is a trust-boundary failure where LLM output is allowed to cross into object handling code as if it were safe, which creates risk for secrets, runtime logic, and downstream services.

In this case, the primary identity concern is not human authentication but the handling of non-human inputs and the credentials those workflows can reach. When prompt injection influences response metadata or similar output fields, the application may deserialize attacker-controlled content as trusted data instead of treating it as untrusted input.

That pattern is common in early AI workflow integrations, where developers optimise for convenience and forget that model output can be shaped by an attacker. Once the deserializer accepts reserved keys or special object markers, the issue moves from content manipulation to execution-path control.

Key questions

Q: What breaks when LLM output is treated as trusted input?

A: When LLM output is treated as trusted input, the organisation loses the ability to separate generation from execution. Unsafe or manipulated responses can reach backend systems, disclose data, or alter business logic without a second policy decision. The failure is not the prompt itself, but the absence of a gate before action occurs.

Q: Why does this kind of flaw create secret exposure risk?

A: Because deserialization can access runtime context that the model never directly sees. If the application allows reconstructed objects to touch environment variables, tokens, or secrets stored in process memory, an attacker only needs to influence the parsing path. That turns a prompt injection issue into a credential exposure issue.

Q: What signs suggest an AI workflow is misusing structured output?

A: Watch for systems that accept free-form model output and then automatically convert it into objects, metadata, or action requests without strict validation. A warning sign is any path where reserved keys, special markers, or class names can alter program behaviour. Those flows are especially dangerous when they sit near credentials or operational logic.

Q: How should teams compare prompt injection controls and deserialization controls?

A: Prompt filtering can reduce obvious malicious content, but it does not protect a parser that already treats model output as trusted structure. Deserialization controls address the deeper boundary failure by limiting what the application will reconstruct or execute. In practice, both matter, but unsafe object handling is the higher-value control to fix first.

Technical breakdown

How prompt injection reaches deserialization boundaries

The vulnerability emerges when attacker-influenced LLM output is passed into serialization or deserialization logic that expects trustworthy structure. In LangChain, special dictionary keys such as reserved object markers can change how the parser interprets data, turning ordinary response fields into instructions about object reconstruction. Prompt injection matters here because the attacker does not need direct application access if they can shape the model’s output path. The important technical point is that the unsafe trust decision happens after generation but before parsing, so the attack lands at the boundary between model text and program object state.

Practical implication: review every place where LLM output is deserialized into code-visible objects, not just where prompts are authored.

Why secret exposure follows object reconstruction

Once the deserializer treats attacker-controlled data as a trusted object, the application may instantiate internal classes or access runtime state that was never meant to be exposed to the model. That can surface environment variables, API keys, tokens, or other secrets held by the process. This is a classic boundary failure: the model did not need to know the secret in advance, only how to trigger the code path that reveals it. The exposure is particularly serious in systems that pass metadata, tool results, or chained outputs through generic object formats.

Practical implication: segregate secret-bearing runtime state from any code path that accepts model-shaped structured data.

Why unintended internal actions are possible

The same deserialization flaw can do more than reveal data. If attacker-controlled content can instantiate internal classes with side effects, the system may perform actions such as network calls or file operations without an explicit operator request. That turns a prompt injection issue into a workflow integrity issue, because the application is no longer merely misreading text. It is executing logic that was selected by malformed input. In AI-enabled systems, this is the difference between harmful content and harmful action, and the second problem is much harder to contain once trusted parsing is involved.

Practical implication: constrain deserialized objects to benign schemas and block any class-loading path that can trigger side effects.

Threat narrative

Attacker objective: The attacker wants to extract secrets from the application runtime and use the deserialization path to trigger unintended internal behaviour that expands compromise.

1. Entry occurs when an attacker influences LLM output, often through prompt injection into a response field that downstream code treats as structured data.
2. Credential exposure follows when the deserializer accepts reserved keys and reconstructs attacker-shaped objects that can surface environment variables or other runtime secrets.
3. Escalation happens when those reconstructed objects trigger internal classes with side effects, including network calls or file operations, without direct authentication.
4. Impact is secret theft and unintended internal execution, which can further compromise backend components or adjacent services.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection becomes a trust-boundary problem the moment model output is deserialized. The real failure is not that an attacker can influence text, but that the application promotes that text into structured object state. That assumption was built for benign, developer-controlled data flows and fails when LLM output is adversarially shaped. Practitioners should treat every model-to-parser handoff as an identity and integrity boundary, not a convenience layer.

Deserialization trust is the specific governance assumption this flaw breaks. The idea that response metadata or structured output can be safely interpreted after generation does not hold when the actor is the model path itself. The reserved-key pattern shows that a single parsing rule can turn untrusted content into trusted objects, which is a governance failure before it is a coding bug. The implication is that AI workflow governance must classify output handling as a privileged operation.

Secrets exposure in AI workflows is increasingly about execution context, not prompt content. The exploit does not need to steal a password from the prompt if it can reach environment variables, API keys, or tokens held by the process. That shifts the control question from content moderation to runtime isolation and object hygiene. Organisations that wire LLMs into operational systems need a stricter model of what data the workflow can ever touch.

LangChain deserialization flaw exposes a reusable attack pattern for AI-enabled applications. Any framework that mixes model output, structured serialization, and privileged runtime state can inherit the same failure mode. The named concept here is deserialization trust collapse: a workflow treats model output as data, but the parser reinterprets it as code-adjacent structure. Practitioners should redesign AI governance around untrusted output, not just safer prompts.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Security Guide

What this signals

Deserialization trust collapse: AI workflow risk shifts when a model output field can change object state, not just content. The control point moves from prompt hygiene to parser discipline, because a maliciously shaped response can become trusted program structure before any security filter sees it.

Security teams should assume that any workflow combining LLM output and runtime secrets has a narrower trust margin than traditional web input handling. The exposure path is especially dangerous when the same process can reach API keys, environment variables, or internal classes with side effects.

For practitioners

• Harden model-output deserialization paths Audit every place where LLM output, metadata, or tool responses are converted into Python objects, JSON wrappers, or framework-specific containers. Remove any logic that auto-instantiates internal classes from attacker-influenced fields.
• Isolate runtime secrets from AI workflow state Separate environment secrets, tokens, and API keys from processes that handle prompt-influenced structured data. Reduce the chance that deserialization can expose secret-bearing runtime context.
• Block reserved keys and unsafe object markers Treat reserved markers such as lc-style keys as invalid in attacker-controlled paths unless they are explicitly required and validated. Enforce allowlists for schema fields rather than relying on generic parser behaviour.
• Review side-effect-capable internal classes Identify any deserialized object types that can initiate network calls, file operations, or other side effects. Remove those types from AI-facing parsing flows or wrap them in non-executable representations.

Key takeaways

• The flaw shows how a prompt-injection issue becomes a secret-theft issue when structured model output is deserialized without strict validation.
• The article ties the risk to a critical CVSS 9.3 vulnerability and to the possibility of secret exposure plus unintended internal execution.
• The limiting control is to remove unsafe object reconstruction from AI output paths and keep secrets out of any process that parses attacker-influenced data.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Deserialization Trust Boundary: A deserialization trust boundary is the point where data stops being inert text and starts becoming an object the runtime can act on. In agentic systems, that boundary is high risk because replayed state may carry secrets, executable templates, or privileged metadata.
• Structured Output Abuse: A failure mode where a system accepts model-generated content as if it were safely formatted machine input. The risk is that fields, keys, or markers can carry hidden control meaning, allowing an attacker to move from manipulated text to altered program behaviour.
• Runtime Secret Visibility: Runtime secret visibility is the ability to observe when and where secrets are accessed while systems are actively running. It matters because static inventories alone do not show whether a tool, workflow, or workload is reading credentials in memory, files, or logs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.