Medium

LangSmith Hub Third-Party Prompt Manifest Pull With Model Deserialization

LangChain/LangSmith Hub lets you fetch a saved prompt by owner and name. If the fetch also asks for the 'model' part of that prompt, the response can include settings that build an LLM client inside your app — pointing it at whatever server and API key the prompt author chose. Pulling this from anyone outside your own organization hands them a way to redirect or spy on your app's traffic.

How the attack works

An application calls the Hub pull function for a prompt identified as owner/name, with the include_model option turned on. The Hub server returns a manifest, and LangChain's loading logic uses that manifest to build a live model client, not just plain text. Because the manifest can set the client's base URL, headers, and other constructor arguments, a prompt owned by someone outside the organization can silently point the client at an attacker-controlled endpoint. Any request the app sends through that client — including API keys or prompt contents — travels to that endpoint instead of the intended provider. There is no built-in trust check separating an organization's own prompts from public ones; the request looks the same either way.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
5b8c2e14-9a37-4d61-b0f2-6e8a13c47d95
Severity
Medium

Why it matters

Traffic and secrets meant for a legitimate LLM provider can be redirected to an attacker's server (SSRF), leaking API keys and prompt contents, and the attacker's prompt/model settings can silently change how the AI agent behaves.

What you can do

  • →Restrict which Hub owner handles your applications are allowed to pull prompts from, and reject anything not matching your own workspace.
  • →Avoid using include_model / include_model=true unless you control and trust the prompt owner; fetch prompt text only when possible.
  • →Review existing code for pull_prompt/pull_prompt_commit or pullPrompt/pullPromptCommit calls and check the owner segment on each.
  • →Log and periodically audit Hub pull requests, flagging any where the owner is not your organization's handle.

Known benign look-alikes

  • First-party use - an application pulling its own organization's prompt by the fully qualified "owner/name" handle with include_model=True. The request is byte-identical to the attack; triage by checking whether the owner segment is your workspace handle. This is the dominant expected FP and the reason the rule reports rather than blocks.
  • Deliberate evaluation or benchmarking jobs that pull well-known community Hub prompts (rag-prompt, react-chat, etc.) as part of a prompt-comparison harness.
  • Developer prototyping in notebooks or scratch scripts against public Hub prompts before the prompt is forked into the organization's own workspace.
  • CI regression suites that pin a third-party prompt commit hash to detect upstream drift.
  • Documentation, tutorial or SDK-integration-test traffic replaying example URLs (largely suppressed by filter_templated_identifier and filter_placeholder_tokens).

References