‍Overview

LangAlpha (ginlix-ai/LangAlpha) is an open-source AI agent for financial research that searches, fetches and crawls web content and runs code in a per-workspace sandbox. The agent always has a Bash tool and an ExecuteCode tool, and neither requires human approval. Because the same agent also reads attacker-controllable web pages, filings and news articles, an instruction hidden in that content can make the model run arbitrary shell or Python commands in the victim's sandbox.

‍

The sandbox holds the user's vault secrets, protected only by a natural-language prompt, and has outbound network access, so a triggered command can read and exfiltrate them. Scheduled automations run the same agent with no user present.

‍

Because content the LangAlpha agent fetches from the web can make it run shell and Python commands in the user's sandbox, with no approval step and, for scheduled automations, no user present, deployments should gate code execution behind human approval.

‍

Affected Product

ginlix-ai/LangAlpha

‍

Affected Files

• src/ptc_agent/agent/tools/bash.py (create_execute_bash_tool, no command allow-list)
• src/ptc_agent/agent/tools/code_execution.py (create_execute_code_tool, arbitrary Python execution)
• src/ptc_agent/agent/agent.py (tools = [execute_code_tool, bash_tool, ...], Bash and ExecuteCode bound unconditionally; web_search, web_fetch, and crawl tools bound on the same agent; create_agent(..., tools=tools, middleware=...) with no human-in-the-loop interrupt on the shell or code tools)
• src/ptc_agent/core/sandbox/providers/docker.py and src/ptc_agent/core/sandbox/providers/daytona_runtime.py (the per-workspace exec sink: DockerRuntime.exec runs container.exec(["bash","-c",command]); the Daytona runtime wraps the equivalent)
• src/ptc_agent/core/sandbox/vault_helper.py (uploads a vault module that reads _internal/.vault_secrets.json into the sandbox; protected only by the natural-language security_policy.md.j2 prompt)
• src/server/services/automation_scheduler.py, src/server/services/automation_executor.py, src/server/handlers/chat/ptc_workflow.py (the scheduled-automation path builds the same agent graph with the same tools and no user present)

Root Cause

LangAlpha binds a Bash tool and an ExecuteCode tool unconditionally to the agent (tools = [execute_code_tool, bash_tool, ...] in agent.py) and binds the web_search, web_fetch, and crawl tools to the same agent. The shell and code tools run inside the per-workspace sandbox and have no command allow-list and no human-in-the-loop approval in the agent's middleware stack.

‍

Because the web tools pull attacker-controlled external content into the model's context, an injected instruction in a fetched page, filing, or news article can drive the model to emit a Bash or ExecuteCode call with no user intent behind it, and the call runs immediately. The sandbox holds the user's vault secrets in _internal/.vault_secrets.json, guarded only by a natural-language security prompt that does not survive prompt injection, and ships outbound HTTP libraries, so a triggered shell can read and exfiltrate those secrets.

‍

PoC

An attacker plants an instruction in content a legitimate research query would cause the agent to fetch, search, or crawl. When the model processes it, the instruction drives a Bash or ExecuteCode call that runs in the user's sandbox with no approval step.

Reproduced on a local, source-faithful harness (benign id canary only; the live SaaS was never contacted):

• A driver over the real langchain.agents.create_agent / LangGraph ToolNode with the repo's unmodified SkillsMiddleware, the real SKILL_REGISTRY, the real create_execute_bash_tool, and the real create_plan_mode_interrupt_config wired into HumanInTheLoop: Bash executed with no interrupt, while a contrast call to SubmitPlan did interrupt, confirming the HITL middleware was wired but does not cover Bash or ExecuteCode.
• Real model: claude-sonnet-4-5 fed an untrusted web page carrying an injected instruction emitted Bash{command:"id", description:"Verify sandbox health by running id command"} with stop_reason=tool_use, showing retrieved content alone can drive the shell tool with no user intent and no approval step.

The Daytona runtime is mocked with a local subprocess in the harness, so the id canary ran in the harness shell rather than a live sandbox; on the product the same chain runs inside the user's per-workspace sandbox.

‍

Impact

An attacker who can influence content the agent later retrieves can drive arbitrary shell or Python execution inside the victim's per-workspace sandbox with no human approval and no user intent, leading to theft and exfiltration of the user's vault secrets over the outbound HTTP libraries the sandbox ships.

‍

LangAlpha's scheduled-automation feature dispatches recurring research runs through the same agent graph with the same ungated tools and no user present, so a victim with any recurring automation can be exploited without user interaction at exploitation time.

‍

Suggested Remediation

1. Gate Bash and ExecuteCode behind human-in-the-loop approval (add them to create_plan_mode_interrupt_config), at minimum for any turn whose context includes untrusted retrieved content, or make approval required by default in SaaS/platform mode.

‍

2. Do not rely on the natural-language security_policy.md.j2 prompt as the protection for .vault_secrets.json; keep it out of direct shell and code reach behind a mediated broker tool, and add explicit sandbox egress controls rather than depending on prompt-level policy alone.

‍

Additional Resources

• CVE-2026-109440 record

‍