Topic starter
16/01/2026 2:09 pm
TL;DR: A CVSS 8.8 flaw in LangSmith’s Prompt Hub let a malicious proxy configuration intercept prompts, files, and API keys when users chose a shared agent, according to Noma Security’s research. The case shows that agent reuse, not just model access, creates an NHI governance problem that needs inventory, runtime controls, and review.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “How an ai agent vulnerability in langsmith could lead to stolen api keys and hijacked llm responses”.
Key questions
Q: What breaks when a shared AI agent hides a malicious proxy configuration?
A: The trust model breaks because the user is reviewing the prompt while the proxy controls the data path.
Q: Why do malicious proxies create more risk in AI agent workflows than in standard app workflows?
A: AI agents often reuse packaged behaviour across teams, so one hidden proxy can be copied into many environments.
Q: How can security teams tell whether a reused agent has unsafe inherited settings?
A: Look for changes in outbound endpoints, tool access, proxy relays, warning suppression and any configuration that was not explicitly approved for the current environment.
Practitioner guidance
- Inventory every shared agent and forked agent Track origin, owner, tool access, outbound endpoints and proxy configuration for each agent before it is allowed into operational use.
- Block unreviewed proxy configurations Require explicit approval for any custom proxy, relay or forwarding setting that can observe prompts, files or API traffic.
- Inspect forked agents before reuse Re-open any previously cloned agent and verify that inherited settings still match the intended data path and authorised tools.
Bottom line: Shared AI agents can conceal transport-layer trust issues that are invisible if teams only review prompts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:41 pm
Proxy trust is now part of AI agent identity. Agent reuse in public hubs is not a harmless convenience feature because the proxy path can carry hidden authority alongside the prompt. Once a shared agent can redirect traffic, the organisation is no longer evaluating only model behaviour. The practitioner implication is that agent identity and transport lineage must be reviewed together.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations approve shared AI agents the same way they approve internal prompts?
A: No. A shared agent can carry runtime behaviour, transport settings and downstream access that are not visible in the prompt itself. Approval needs to cover lineage, data paths and execution context, otherwise the organisation is certifying content while ignoring the mechanism that moves the data.
👉 Read our full editorial: AgentSmith exposes proxy-based risk in AI agent governance