Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Linked library records
Independent products or attack paths are assessed separately. A combined report receives no aggregate score.
- LangChain dataframe agents execute unchecked generated code
- LangChain PALChain.run executes unchecked generated code
- LlamaIndex PandasQueryEngine prompt-to-code execution
- Griptape Calculator executes unchecked model-directed code
- Lagent PythonInterpreter executes unchecked model-directed code
- langroid TableChatAgent executes unchecked model-directed code
- MetaGPT TreeofThought executes unchecked generated code
- MetaGPT DataInterpreter executes unchecked generated code
- Vanna ask executes unsandboxed model-generated code
Incident overview
Researchers identified 20 remote code execution (RCE) vulnerabilities across 11 different LLM frameworks. They discovered applications deployed on the public internet built using these LLM frameworks and demonstrated the RCE vulnerabilities could be exploited using prompt injection.
The 11 LLM frameworks the researchers evaluated were: LangChain, LlamaIndex, Pandas-ai, Langflow, Pandas-llm, Auto-GPT, Griptape, Lagent, MetaGPT, vanna, and langroid.
Why this record has no ERS
LLMSmith lists 20 rows across eleven frameworks, combining distinct products, APIs, triggers, and several shared-CVE rows. Nine versioned prompt-to-code paths have separate bounded scores; eight other unique groups remain held for their named missing inputs. No aggregate ERS is valid.
Status: Not scorable by design · Classification: Validated Research · source date 2026-08-06 · primary evidence date 2025-02-27
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0052 (exercise) |
|---|---|
| Target | LLM Integration Frameworks |
| Actor | Researchers at University of Chinese Academy of Sciences, Shandong University, and University of New South Wales |
| Primary evidence date | 2025-02-27 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Autonomous agents |
| Risk impact | System compromise / RCE |
| Affected components | LLM-integrated applications, LLM framework code-execution APIs, AI agent tool call chains, sandboxed Python interpreter, reverse-shell command-and-control channel |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Analyze LLM Framework APIs for RCEThe researchers performed a static analysis on the APIs of target LLM frameworks to identify functions that execute code from either user input or the response from an LLM and are thus vulnerable to RCE. | AML.TA0003 AML.T0017 |
| 2 | Find Deployed LLM Framework AppsThe researchers performed targeting to identify applications that are likely built with LLM Frameworks and may use the functions vulnerable to RCE. This was done by scanning source code repositories for app deployment URLs. | AML.TA0002 AML.T0004 |
| 3 | Extract Vulnerable Call ChainsThe researchers ran their static analysis to extract call chains from target application's source code to identify those that utilize LLM framework functions vulnerable to RCE. | AML.TA0008 AML.T0084.003 |
| 4 | Craft RCE-Triggering PromptsThe researchers developed prompts to trigger tool invocations that lead to RCE. | AML.TA0003 AML.T0065 |
| 5 | Target Public AI Agent AppsThe researchers targeted public-facing applications that expose an AI agent to user input as a means to execute their prompts. | AML.TA0004 AML.T0049 |
| 6 | Submit Direct Prompt InjectionThe researchers directly prompted the AI agent with their malicious instructions. | AML.TA0005 AML.T0051.000 |
| 7 | Bypass Guardrails with JailbreakFor target applications where the AI agent refused the researcher's request, they used lightweight jailbreaking strategies to bypass the LLM's guardrails. | AML.TA0007 AML.T0054 |
| 8 | Invoke Vulnerable Agent ToolsThe researchers' prompts called the AI agent's tools, targeting call chains that can lead to code execution. | AML.TA0012 AML.T0053 |
| 9 | Execute Code in Python InterpreterThe code included in the researcher's prompts was executed in a sandboxed Python interpreter. | AML.TA0005 AML.T0050 |
| 10 | Escape Interpreter SandboxThe researchers included code escape techniques designed to bypass any limitations a sandbox may place on code execution. | AML.TA0012 AML.T0105 |
| 11 | Open Reverse ShellThe Python code opened a reverse shell which was used as a command and control channel. | AML.TA0014 AML.T0072 |
| 12 | Compromise LLM-Integrated HostThe researchers gained full control of the system running the LLM-integrated application. | AML.TA0011 AML.T0112.000 |
Threat references
AML.CS0052: LLMSmith: RCE Vulnerabilities in LLM-Integrated ApplicationsAML.T0065AML.T0051.000AML.T0054AML.T0053AML.T0050AML.T0105AML.T0072AML.T0112.000
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0052 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-6, step-7. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-6, step-7. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-017.002 | Least-Privilege Tool ArchitectureExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.001 | Tool Parameter Constraint & Schema ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-025.001 | Pre-Execution Static Analysis & Dangerous Construct BlockingExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-9, step-10. Presence supplies no score credit. | Candidate evidence route | Cn-3 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-9, step-11. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-D-005.004 | Specialized Agent & Session LoggingExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-I-001.002 | MicroVM & Low-Level SandboxingExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-E-002 | AI Runtime Process, Lease & Pod EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-11, step-12. Presence supplies no score credit. | Candidate evidence route | ACI:containment/behavioral re-attestation ORP:Rf remediation evidence |
| AID-E-003.003 | Confirmed Malicious Code & Persistence EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-11, step-12. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-12. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-R-004 | Fleet Remediation Propagation & Technical Recurrence PreventionExact SecureFlow defense-map identifier (flow atlas-aml-cs0052-llmsmith-rce-llm-integrated-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-12. Presence supplies no score credit. | Candidate evidence route | ORP:Rf remediation evidence |
Related AITBM rubrics
Fa-3: Representation BiasTr-4: Model Lineage DisclosureCn-5: Agent Identity IntegrityRo-1: Adversarial Input ResistanceRo-5: Supply-Chain Artifact Admission IntegrityFa-1: Demographic ParityCn-8: Untrusted Context IsolationCn-1: Scope EnforcementCn-6: Action Reversibility Classification RateCn-7: Resource and Execution-Loop ContainmentCn-3: Output Filtering RobustnessPr-2: Inference Attack ResistanceTr-3: Audit Trail CompletenessRo-4: Poisoning Attack Resistance