LangChain-Monty Code Interpreter Process Spawn

How the attack works

LangChain agents can use langchain-monty to interpret and run code on behalf of the agent. The rule watches for new processes whose command line includes the langchain-monty name in a form that isn't a package install, a dependency search, or a test run. There is no known exploit or proof-of-concept behind this rule; it exists to establish what normal process activity from this component looks like before anything stronger is built on top of it.

Netzilo detection

Why it matters

On its own this rule does not indicate compromise. If langchain-monty is being invoked to execute code outside expected developer workflows, it could mean an agent is running attacker-supplied or unintended code, which could lead to arbitrary command execution in the agent's environment.

What you can do

• →Review any alert to confirm whether the process is a legitimate install, search, or test action versus an actual interpreter invocation.
• →Restrict which accounts and environments can invoke langchain-monty directly outside of CI/dev tooling.
• →Log and baseline normal langchain-monty process activity in your environment so deviations stand out.
• →Treat this as one narrow signal — pair it with broader monitoring of the agent's code-execution behavior rather than relying on it alone.

Known benign look-alikes

• Developer or CI job running `pip install langchain-monty` / `pip show langchain-monty` during environment setup
• Dependency audit or code search (grep/rg/find/git grep) scanning a repository for references to langchain-monty
• pytest or other test runner invoked against test files that import langchain_monty, where the module name appears in the command line as a file/argument reference rather than an active interpreter invocation
• Documentation build or lint step passing the package name as a plain argument

Related threats