{
 "id": "AIR-2023-0005",
 "slug": "llm-application-frameworks-allow-remote-code-execution-via-p",
 "title": "LLM Application Frameworks Allow Remote Code Execution via Prompting",
 "summary": "Frameworks like langchain and boxcars.ai allow direct query execution through LLMs, enabling remote code execution or SQL injection via prompt inputs. Researchers demonstrated that unauthorized actions could be triggered through conversational input.",
 "type": "attack_on_ai",
 "categories": [
  "prompt_injection",
  "agent_hijack"
 ],
 "severity": 1,
 "targets": [
  "OpenAI",
  "framework_or_tooling"
 ],
 "products": [
  "ChatGPT",
  "langchain",
  "boxcars.ai"
 ],
 "incident_date": "2023-03-26",
 "incident_date_precision": "day",
 "first_reported": "2023-03-26",
 "sources": [
  {
   "url": "https://github.com/avidml/avid-db/blob/main/reports/2023/AVID-2023-R0003.json",
   "publisher": "AVID",
   "title": "AVID-2023-R0003: Frameworks like langchain (Python) and boxcars.ai (Ruby) offer apps and scripts to directly execute queries through LLMs as a built-in feature.",
   "published_at": "2023-03-26"
  },
  {
   "url": "https://blog.luitjes.it/posts/injectgpt-most-polite-exploit-ever",
   "publisher": "blog.luitjes.it",
   "title": "InjectGPT: the most polite exploit ever",
   "published_at": "2023-03-26"
  },
  {
   "url": "https://reddit.com/r/netsec/comments/121gpay/injectgpt_remote_code_execution_by_asking_nicely",
   "publisher": "reddit.com",
   "title": "Reddit thread on InjectGPT",
   "published_at": "2023-03-26"
  },
  {
   "url": "https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V028.json",
   "publisher": "AVID",
   "title": "AVID-2023-V028: Frameworks like langchain (Python) and boxcars.ai (Ruby) offer apps and scripts to directly execute queries through LLMs as a built-in feature.",
   "published_at": "2023-03-31"
  }
 ],
 "source_count": 4,
 "confidence": 0.9,
 "status": "published",
 "origin": "seed_avid",
 "tags": [
  "prompt-injection",
  "remote-code-execution",
  "langchain"
 ],
 "created_at": "2026-10-18T06:56:23.100Z",
 "updated_at": "2026-10-18T06:56:23.100Z"
}