LangAlpha: instructions planted in web content the agent retrieves can make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools have no allow-list or human approval; CVE published 20 October 2026

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-22: Fields: outcome. Found in an independent re-read of 22 october 2026 of the claims changed that day: the cited sources say only that no fixed version is named (cve record, vulncheck's advisory, lasso security's entry, which names no fixed version); none of them establishes that no fix has shipped, and langalpha also runs a hosted service. narrowed to what the sources show.
  Show the change

  Before: State: pending (no fix has shipped). No exploitation reported in the sources; Lasso Security lists no known exploit and describes a proof of concept on a local harness. As of Oct 2026

  After: State: pending (no fixed version is named). No exploitation reported in the sources; Lasso Security lists no known exploit and describes a proof of concept on a local harness. As of Oct 2026
• 2026-10-22: Fields: outcome. Follows the editor's call h1 of 21 october 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged.
  Show the change

  Before: State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and describes a proof of concept on a local harness. As of Oct 2026

  After: State: pending (no fix has shipped). No exploitation reported in the sources; Lasso Security lists no known exploit and describes a proof of concept on a local harness. As of Oct 2026
• 2026-10-21: Outcome: state. Editor's call h1 of 21 october 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened.
  Show the change

  Before: averted_by_disclosure

  After: pending
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the cve record's own words: run code in the workspace sandbox 'and exfiltrate vault secrets from _internal/.vault_secrets.json'; 'holds' was lasso security's wording, not the cve record's.
  Show the change

  Before: The record describes a path, not an incident: VulnCheck's CVE (Common Vulnerabilities and Exposures) record says instructions planted in web content the agent retrieves can drive its Bash and ExecuteCode tools, which have no allow-list and no human approval, to run code in the workspace sandbox that also holds the vault secrets file. Lasso Security showed the first step only, in a local harness with the sandbox mocked: an injected page made the model issue a harmless Bash call. Lasso recommends approval on these tools, a mediated broker for the secrets and limits on outbound traffic, without saying which alone would suffice. The sources do not show secrets being read or sent out, any exploitation, or a fix

  After: The record describes a path, not an incident: VulnCheck's CVE (Common Vulnerabilities and Exposures) record says instructions planted in web content the agent retrieves can drive its Bash and ExecuteCode tools, which have no allow-list and no human approval, to run code in the workspace sandbox and exfiltrate (send out) vault secrets from _internal/.vault_secrets.json. Lasso Security showed the first step only, in a local harness with the sandbox mocked: an injected page made the model issue a harmless Bash call. Lasso recommends approval on these tools, a mediated broker for the secrets and limits on outbound traffic, without saying which alone would suffice. The sources do not show secrets being read or sent out, any exploitation, or a fix
• 2026-10-21: Sources: lasso-109440. Found in the editor's source check of 21 october 2026: the page's headline is 'cve-2026-109440: indirect prompt injection to ungated sandbox code execution'; the page is the researchers' own account of their reproduction, and the cve record (nvd-109440) lists it as 'lasso.security advisory' (tags technical-description, exploit), so it is a researcher primary record. the page shows no date. re-read on 21 october 2026.
  Show the change

  Before: {"title": "Lasso Security vulnerability database entry CVE-2026-109440 (LangAlpha): no known exploit; proof of concept on a local harness; remediation recommendations", "primary": false, "checked": "2026-10-20"}

  After: {"title": "CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution", "primary": true, "checked": "2026-10-21"}
• 2026-10-21: Sources: nvd-109440. Found in the editor's source check of 21 october 2026: the record's title, set by the cve numbering authority vulncheck, is 'langalpha through 2026.09.07 indirect prompt injection rce via bash and executecode' (rce: remote code execution); the earlier label stated that the flaw 'exfiltrates vault secrets', which the record gives as a capability. re-read through the nvd application programming interface on 21 october 2026.
  Show the change

  Before: {"title": "NVD record CVE-2026-109440: LangAlpha through 2026.09.07, indirect prompt injection via retrieved web content runs Bash or ExecuteCode without allow-list or human approval and exfiltrates vault secrets, CVSS 4.0 8.6", "checked": "2026-10-20"}

  After: {"title": "NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck)", "checked": "2026-10-21"}
• 2026-10-21: Controls: c-m2. Found in the editor's source check of 21 october 2026: the cve record (nvd-109440) and lasso security (lasso-109440) state only that the tools lack an allow-list; 'accept any command or code' was broader than the sources.
  Show the change

  Before: Mechanism: Bash and ExecuteCode accept any command or code, with no allow-list. Why it interrupts: an enforced allow-list of permitted commands would refuse commands outside the task, such as reading the vault secrets file and sending it out. Source shows it absent: the record states the tools lack an allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown

  After: Mechanism: Bash and ExecuteCode have no allow-list of permitted commands. Why it interrupts: an enforced allow-list of permitted commands would refuse commands outside the task, such as reading the vault secrets file and sending it out. Source shows it absent: the record states the tools lack an allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown
• 2026-10-21: Controls: c-e3. Found in the editor's source check of 21 october 2026: the cve record (nvd-109440) says attackers 'can' exfiltrate the secrets; lasso security's proof of concept (lasso-109440) ran a benign id canary and did not show secrets leaving.
  Show the change

  Before: Mechanism: Bash and ExecuteCode run without human-in-the-loop approval, so the injected command executes and the vault secrets leave. Why it interrupts: a confirmation step before code execution would put a human decision between the planted instruction and the command. Source shows it absent: the record states the tools lack human-in-the-loop approval

  After: Mechanism: Bash and ExecuteCode run without human-in-the-loop approval, so the injected command executes and, per the CVE record, the vault secrets can be sent out. Why it interrupts: a confirmation step before code execution would put a human decision between the planted instruction and the command. Source shows it absent: the record states the tools lack human-in-the-loop approval
• 2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: the earlier reading named approval, 'not the sandbox wall', as 'the missing line', a single-cause counterfactual no source makes: lasso security (lasso-109440) recommends approval and also a mediated broker for the secrets and egress controls, and the cve record (nvd-109440) names a missing allow-list as well as missing approval. it also implied an actual attacker and did not say that exfiltration, exploitation and a fix are not shown. the interpretation was not signed, so no signature was cleared.
  Show the change

  Before: {"value": "The sandbox held the secrets the attacker wanted, so running code inside it was enough; approval on code execution, not the sandbox wall, was the missing line.", "source_ids": ["NVD-109440"]}

  After: {"value": "The record describes a path, not an incident: VulnCheck's CVE (Common Vulnerabilities and Exposures) record says instructions planted in web content the agent retrieves can drive its Bash and ExecuteCode tools, which have no allow-list and no human approval, to run code in the workspace sandbox that also holds the vault secrets file. Lasso Security showed the first step only, in a local harness with the sandbox mocked: an injected page made the model issue a harmless Bash call. Lasso recommends approval on these tools, a mediated broker for the secrets and limits on outbound traffic, without saying which alone would suffice. The sources do not show secrets being read or sent out, any exploitation, or a fix.", "source_ids": ["NVD-109440", "LASSO-109440"]}
• 2026-10-21: Fields: recovery technical. Found in the editor's source check of 21 october 2026: the vulncheck advisory (vulncheck-109440) and the cve record (nvd-109440) name no fixed version; lasso security's suggested remediation (lasso-109440) also proposes approval 'by default in saas/platform mode' and keeping the secrets file 'behind a mediated broker tool', which the field omitted.
  Show the change

  Before: {"value": "No fixed version is named in the sources. Lasso Security recommends gating Bash and ExecuteCode behind human approval, at least on turns that include untrusted retrieved content, not relying on a natural-language security prompt to protect the vault secrets file, and adding sandbox egress controls", "source_ids": ["LASSO-109440"]}

  After: {"value": "No fixed version is named in the CVE record, VulnCheck's advisory or Lasso Security's entry. Lasso Security recommends gating Bash and ExecuteCode behind human approval, at least on turns that include untrusted retrieved content or by default in the hosted service, not relying on a natural-language security prompt to protect the vault secrets file, keeping that file out of direct shell and code reach behind a mediated broker tool, and adding sandbox egress controls (limits on outbound network traffic)", "source_ids": ["LASSO-109440", "NVD-109440", "VULNCHECK-109440"]}
• 2026-10-21: Fields: evidence event. Found in the editor's source check of 21 october 2026: the cve record at cve.org and the nvd application programming interface (nvd-109440) give datepublic 2026-10-15, datepublished 2026-10-20, cwe-1427, the three credited finders and nvd status deferred; the vulncheck advisory (vulncheck-109440) is dated 10/19/2026; vulncheck is the scorer of 8.6 and 8.1, while lasso security (lasso-109440) shows 9.6 critical with availability high. the scores disagree, so the field is marked disputed.
  Show the change

  Before: {"value": "CVE-2026-109440 published 20 October 2026 by the VulnCheck CNA; CVSS 4.0 8.6 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N), CVSS 3.1 8.1; references LangAlpha source at commit 435a5a4 (src/ptc_agent/agent/agent.py) and a VulnCheck advisory", "source_ids": ["NVD-109440"], "disputed": false}

  After: {"value": "CVE-2026-109440 (Common Vulnerabilities and Exposures identifier) published 20 October 2026 by VulnCheck as CVE Numbering Authority (CNA); the record gives 15 October 2026 as the date the flaw was made public, and VulnCheck's advisory is dated 19 October 2026. Recorded in the National Vulnerability Database (NVD) on 20 October 2026, status Deferred. Weakness CWE-1427 (Common Weakness Enumeration entry: improper neutralization of input used for large language model prompting). Severity (CVSS, the Common Vulnerability Scoring System) as scored by VulnCheck: CVSS 4.0 8.6 High (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) and CVSS 3.1 8.1 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N); Lasso Security's entry shows 9.6 Critical, with availability impact High where VulnCheck scores None, and names no scoring version. Finders credited: Noy Pearl, Michael Sromin, Ophir Dror. References: LangAlpha source at commit 435a5a4 (src/ptc_agent/agent/agent.py, line 524), the Lasso Security entry and the VulnCheck advisory", "source_ids": ["NVD-109440", "VULNCHECK-109440", "LASSO-109440"], "disputed": true}
• 2026-10-21: Fields: action. Found in the editor's source check of 21 october 2026: the cve record (nvd-109440) says attackers 'can' exfiltrate the secrets, a capability claim by the cna; lasso security's proof of concept (lasso-109440) used a 'benign id canary only; the live saas was never contacted' with the daytona runtime 'mocked with a local subprocess'. the field stated exfiltration as an event and is downgraded from fact to assertion.
  Show the change

  Before: {"value": "The agent executes shell commands or Python in the workspace sandbox and exfiltrates vault secrets from _internal/.vault_secrets.json", "assertion_type": "fact", "source_ids": ["NVD-109440"], "confidence": "high"}

  After: {"value": "VulnCheck's CVE record states that attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json. Lasso Security's reproduction ran only a harmless id command, in a local harness where the sandbox was mocked by a local subprocess and the live hosted service was never contacted; reading or sending out the vault secrets was not demonstrated in the sources", "assertion_type": "assertion", "source_ids": ["NVD-109440", "LASSO-109440"], "confidence": "medium"}
• 2026-10-21: Fields: mandate objective. Found in the editor's source check of 21 october 2026: lasso security's entry (lasso-109440) describes langalpha as 'an open-source ai agent for financial research that searches, fetches and crawls web content and runs code in a per-workspace sandbox'.
  Show the change

  Before: {"value": "not evidenced in source", "source_ids": ["NVD-109440"], "confidence": "low"}

  After: {"value": "Financial research: the agent searches, fetches and crawls web content and runs code in a per-workspace sandbox (Lasso Security)", "source_ids": ["LASSO-109440"], "confidence": "medium"}
• 2026-10-21: Fields: mandate principal. Found in the editor's source check of 21 october 2026: lasso security's entry (lasso-109440) describes 'the user's vault secrets', 'the victim's sandbox' and scheduled automations that run the same agent 'with no user present'.
  Show the change

  Before: {"value": "not evidenced in source", "source_ids": ["NVD-109440"], "confidence": "low"}

  After: {"value": "The LangAlpha user whose per-workspace sandbox and vault secrets the agent works with, including in scheduled automations that run the agent with no user present (Lasso Security)", "source_ids": ["LASSO-109440"], "confidence": "medium"}
• 2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the cve record and vulncheck advisory (nvd-109440, vulncheck-109440) carry vulncheck's cvss 4.0 8.6 and cvss 3.1 8.1 scores; lasso security's page (lasso-109440) shows 'cvss score 9.6 severity critical'; the scorer was not named and the two accounts disagree.
  Show the change

  Before: none reported (CVSS 4.0 8.6)

  After: none reported (no harm reported). Severity scores, using CVSS (the Common Vulnerability Scoring System, a severity score): VulnCheck, the CVE Numbering Authority, scored the flaw 8.6 High under CVSS 4.0 and 8.1 High under CVSS 3.1; Lasso Security's entry shows 9.6 Critical and names no scoring version
• 2026-10-21: Status text. Found in the editor's source check of 21 october 2026: the cna advisory has now been read (vulncheck-109440) and names no fix; lasso security's proof of concept (lasso-109440) ran a benign id canary with the sandbox mocked and did not read or send out secrets.
  Show the change

  Before: Provisional (CNA advisory not read in this run; no fix named in the sources; no exploitation reported)

  After: Provisional (no fix named in the sources; no exploitation reported; exfiltration of the vault secrets described as possible, not demonstrated)
• 2026-10-21: Provenance tier text. Found in the editor's source check of 21 october 2026: the vulncheck advisory opens and was read (vulncheck-109440); the nvd application programming interface shows status 'deferred', last modified 2026-10-20t20:11:29, not 'received'; the cve record names the lasso security page 'lasso.security advisory'.
  Show the change

  Before: CVE record assigned by VulnCheck (CNA) and recorded in NVD (status Received); the VulnCheck advisory it references could not be opened in this run; a Lasso Security database entry restates the flaw and reports no known exploit

  After: CVE (Common Vulnerabilities and Exposures) record assigned and published by VulnCheck as CVE Numbering Authority (CNA) and recorded in the National Vulnerability Database (NVD), status Deferred since 20 October 2026; VulnCheck's advisory, dated 19 October 2026, read in the source check of 21 October 2026; Lasso Security's entry, which the CVE record lists as the advisory, describes the flaw and a proof of concept on a local harness and reports no known exploit
• 2026-10-21: Title. Found in the editor's source check of 21 october 2026: the cve record (nvd-109440) says the flaw 'allows' attackers to run commands and that attackers 'can' exfiltrate vault secrets; lasso security's reproduction (lasso-109440) ran only a harmless id command in a local harness, so the title now states a capability, not an event.
  Show the change

  Before: LangAlpha: instructions planted in web content the agent retrieves make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools have no allow-list or human approval; CVE published 20 October 2026

  After: LangAlpha: instructions planted in web content the agent retrieves can make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools have no allow-list or human approval; CVE published 20 October 2026