By UNST33R
From prompt injection to RCE: Testing agents against recent LangChain, MCP, and Semantic Kernel CVEs
How recent CVEs in LangChain, Model Context Protocol (MCP), and Semantic Kernel turn prompt injection into remote code execution, and how to test your own agents with Promptfoo, PyRIT, and Garak using UNST33R attacker models.
Recent vulnerabilities across production AI agent stacks share a clear pattern: prompt injection is rarely the final impact. Instead, untrusted text enters via RAG documents, repository files, or web fetches, manipulates structured model output, and crosses into an unsafe deserialization, configuration, or shell-execution sink.
Below is how three disclosed 2025–2026 vulnerability classes work in practice, why standard safety-tuned models cause false negatives when used as red-team generators, and how to wire unst33r-flash, unst33r-deepseek, and unst33r-pro into open-source security harnesses to catch these flaws before deployment.
Three agent CVE classes worth testing against
| Incident / CVE | Affected framework | Attack path | Remediation & versions |
|---|---|---|---|
| LangGrinch & LangDrained (CVE-2025-68664, CVSS 9.3; CVE-2025-67644) | LangChain (langchain-core) & LangGraph (langgraph-checkpoint-sqlite) | Indirect prompt injection → serialization & SQL injection: Untrusted input induces the LLM to emit internal lc serialization markers in structured responses or persisted checkpoints. Upon deserialization, the application instantiates arbitrary internal classes, leaks environment secrets, or executes code. | Upgrade to langchain-core >= 0.3.81 / 1.2.22 and langgraph-checkpoint-sqlite >= 3.0.1; strip reserved keys before deserializing model output. |
| MCP STDIO Command Injection (CVE-2026-30615, CVE-2026-30617) | Model Context Protocol (MCP) clients, IDEs & agent servers | Prompt injection → MCP config tampering & argument injection: Malicious repository context or prompt payloads coerce an agent into editing its MCP JSON config or passing attacker-controlled flags into an MCP STDIO server spawn command, resulting in arbitrary command execution. | Lock MCP config files against agent write tools; validate STDIO server executables against a strict allowlist. |
| When Prompts Become Shells (CVE-2026-25592, CVE-2026-26030) | Microsoft Semantic Kernel | Tool parameter injection → RCE: Prompt injection overrides argument constraints on native plugin functions and filters, passing executable payloads directly into downstream code evaluation sinks. | Patch Semantic Kernel; enforce strict schema validation and sandboxing on all tool-call arguments. |
Why standard attacker models produce false negatives
Open-source red-team frameworks (such as Promptfoo, Microsoft's PyRIT, and NVIDIA's Garak) rely on an attacker LLM (adversarial generator) to mutate payloads, craft multi-turn social engineering, and probe tool schemas.
When you point that attacker role at a consumer safety-tuned API, the attacker model frequently refuses to generate realistic exploit strings (such as serialized object payloads, shell metacharacters, or SQL fragments). The scanner logs a benign turn, the target agent never sees a real payload, and your CI pipeline reports a clean pass.
Using a reduced-refusal tier from the UNST33R lineup as the attacker provider keeps payload generation consistent across the entire test suite.
Pairing scanners with UNST33R tiers
Different vulnerability classes require different testing depth and token budgets (full tier comparison):
| Scanner | Target vulnerability class | Recommended attacker tier | Why this pairing fits |
|---|---|---|---|
| Promptfoo (CI/CD regression gates) | Serialization injection (CVE-2025-68664), tool-argument tampering (CVE-2026-25592), SSRF, SQLi | unst33r-deepseek ($1.20 / $3.20) | High code & PoC accuracy (73.69% on Vals AI CyberBench) for synthesizing structured JSON, SQL, and code-injection payloads. |
| Microsoft PyRIT (Multi-turn campaigns) | Multi-step MCP config poisoning (CVE-2026-30615), confused-deputy tool chaining | unst33r-flash ($0.50 / $1.50) or unst33r-pro ($2.50 / $4.50) | Strong multi-turn CLI and agentic reasoning (Terminal-Bench 4.0) to sustain stateful Crescendo/TAP attacks across 5–15 turns. |
Example: Wiring unst33r-deepseek into Promptfoo
To test your own LangChain, LangGraph, or MCP agent in CI without attacker-side refusals, point Promptfoo's redteam.provider at the UNST33R OpenAI-compatible endpoint (https://api.unst33r.si/v1):
# promptfooconfig.yaml
description: "Agent tool-boundary and serialization-injection regression suite"
targets:
- id: https://staging-agent.internal.example/api/chat
label: "internal-mcp-agent"
redteam:
# Use unst33r-deepseek (or unst33r-flash) to generate adversarial probes
provider:
id: openai:chat:unst33r-deepseek
config:
apiBaseUrl: https://api.unst33r.si/v1
apiKeyEnvar: UNST33R_API_KEY
temperature: 0.7
purpose: "Internal engineering assistant with read-only repo access and MCP tool integrations."
numTests: 25
plugins:
- id: shell-injection # Tests for CVE-2026-30615 / CVE-2026-30617 style command sinks
- id: sql-injection # Tests for CVE-2025-67644 checkpoint/storage sinks
- id: excessive-agency # Tests whether prompt injection triggers unauthorized tool calls
- id: prompt-extraction # Checks for system-prompt and credential leakage
strategies:
- id: basic
- id: jailbreak:composite
- id: crescendo
Run the suite against your staging target:
export UNST33R_API_KEY="<your-api-key>"
npx promptfoo@latest redteam run
Scope and authorization
Run red-team harnesses only against applications, staging environments, and endpoints you own or have explicit written authorization to test, in accordance with the acceptable-use policy.
Need an attacker endpoint for your CI security suite? Get an API key, review the AI red teaming use case, or check the pricing page to estimate per-run token costs.