What happened
LangAlpha through 2026.09.07 is vulnerable to indirect prompt injection: an attacker plants instructions in web content the agent retrieves, and because the Bash and ExecuteCode tools have no allow-list and no human-in-the-loop approval, the agent executes shell/Python in the workspace sandbox. This enables exfiltration of vault secrets from _internal/.vault_secrets.json.
Why it matters
This is a concrete agent-execution attack class where untrusted retrieved content escalates to code execution inside an agent workspace and secret theft. It shows that a cost-free read of a web page — not a direct request — can be turned into RCE and credential disclosure in an agent that lacks an approval gate on its code/shell tools.
Attack vector
Indirect prompt injection through retrieved web content driving unapproved Bash/ExecuteCode execution
Affected systems
LangAlpha <= 2026.09.07 (ginlix-ai)
Mitigation
Add an allow-list and human-in-the-loop approval gate on Bash/ExecuteCode; treat agent vault secrets as reachable from the sandbox