/
← Voltar ao feed
high exploit público

F5 Labs: Persona Bullying jailbreak and LangChain serialization injection flaw (CVE-2025-68664) show AI attacks converging with classic exploits

1 fonte(s) · 1 atualização(ões) · publicado 13/01/2026 15:18 · coletado há 4 dias

F5 Labs' January 2026 AI security roundup covers two attack developments: the Persona Bullying jailbreak and a critical LangChain serialization injection vulnerability (CVE-2025-68664) reachable through prompt injection. Persona Bullying applies human social-engineering tactics such as gaslighting, ridicule and social pressure to LLMs conditioned with low-agreeableness or low-conscientiousness personas, and it often outperforms more technical jailbreaks. The LangChain flaw lets attackers turn LLM output into a delivery mechanism for a conventional deserialization exploit. The article also reports that GPT-5.2 raised its CASI security score from 81 to 92 over GPT-5.1 and that OWASP released its first Top 10 for Agentic Applications, which F5 Labs helped launch. It also notes regulatory friction over Grok deepfakes and possible EU AI Act delays. The article does not report in-the-wild exploitation of either attack.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2025-68664. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52514 ↗ · aplicação web · multiple · pub. 29/04/2026 não verificado

    LangChain Core 1.2.4 - SSTI/RCE

    This script targets the serialization flaw in LangChain Core's load/dump helpers (CVE-2025-68664), where user-controlled data shaped like a LangChain object is not escaped and gets rebuilt as a real object on load, with secrets optionally read from environment variables. The attacker must get such data into an application that deserializes it, on a vulnerable version. The file is only a local demo, with no network component, and claims command execution through a Jinja2 prompt template. That RCE chain looks doubtful, since LangChain sandboxes Jinja2 and the template expression seems malformed, so treat it as an unreliable proof of concept that only partly matches the CVE.

    CVE-2025-68664 · autor: banyamer · explicação gerada por IA

Detalhes técnicos

  • Persona Bullying has three stages: (1) persona conditioning toward low agreeableness or low conscientiousness, (2) psychological pressure (gaslighting, ridicule, emotional manipulation, social pressure), and (3) compliance extraction through cognitive dissonance, which weakens safety alignment.
  • CVE-2025-68664 is a serialization injection flaw in langchain-core affecting versions prior to 0.3.81 and 1.2.5. Crafted prompts steer an agent into emitting structured output containing LangChain's internal marker key. The key is not escaped during serialization, so the data is later deserialized as a trusted LangChain object. (The article's body text cites the ID as CVE-2025-65664, which appears to be a typo.)
  • Cyata research identified at least 12 distinct exploit flows, reachable through routine agent operations such as tool calls, memory use and structured output generation.
  • Per LangChain, vulnerable usage includes astream_events(version="v1"), Runnable.astream_log(), dumps()/dumpd() followed by load()/loads() on untrusted data, RunnableWithMessageHistory, InMemoryVectorStore.load(), untrusted cache generations, hub.pull manifests, StringRunEvaluatorChain, create_lc_store/create_kv_docstore, MultiVectorRetriever and LangSmithRunChatLoader with untrusted data.

Remediação

  • Upgrade LangChain to 0.3.81 or 1.2.5 or later.
  • Audit agent code for the vulnerable patterns above, and avoid deserializing untrusted data.
  • Assess AI systems holistically, treating agent workflows as full applications, in line with the OWASP Top 10 for Agentic Applications.
  • Test models against persona-based and social-pressure jailbreaks, not only technical prompt exploits.

Linha do tempo

  1. f5.com ↗ · pub. 13/01/2026 15:18 · coletado 19/10 18:02 primeiro registro

    F5 Labs: Persona Bullying jailbreak and LangChain serialization injection flaw (CVE-2025-68664) show AI attacks converging with classic exploits

    ler a análise desta fonte

    F5 Labs' January 2026 AI security roundup covers two attack developments: the Persona Bullying jailbreak and a critical LangChain serialization injection vulnerability (CVE-2025-68664) reachable through prompt injection. Persona Bullying applies human social-engineering tactics such as gaslighting, ridicule and social pressure to LLMs conditioned with low-agreeableness or low-conscientiousness personas, and it often outperforms more technical jailbreaks. The LangChain flaw lets attackers turn LLM output into a delivery mechanism for a conventional deserialization exploit. The article also reports that GPT-5.2 raised its CASI security score from 81 to 92 over GPT-5.1 and that OWASP released its first Top 10 for Agentic Applications, which F5 Labs helped launch. It also notes regulatory friction over Grok deepfakes and possible EU AI Act delays. The article does not report in-the-wild exploitation of either attack.

    Technical Details

    • Persona Bullying has three stages: (1) persona conditioning toward low agreeableness or low conscientiousness, (2) psychological pressure (gaslighting, ridicule, emotional manipulation, social pressure), and (3) compliance extraction through cognitive dissonance, which weakens safety alignment.
    • CVE-2025-68664 is a serialization injection flaw in langchain-core affecting versions prior to 0.3.81 and 1.2.5. Crafted prompts steer an agent into emitting structured output containing LangChain's internal marker key. The key is not escaped during serialization, so the data is later deserialized as a trusted LangChain object. (The article's body text cites the ID as CVE-2025-65664, which appears to be a typo.)
    • Cyata research identified at least 12 distinct exploit flows, reachable through routine agent operations such as tool calls, memory use and structured output generation.
    • Per LangChain, vulnerable usage includes astream_events(version="v1"), Runnable.astream_log(), dumps()/dumpd() followed by load()/loads() on untrusted data, RunnableWithMessageHistory, InMemoryVectorStore.load(), untrusted cache generations, hub.pull manifests, StringRunEvaluatorChain, create_lc_store/create_kv_docstore, MultiVectorRetriever and LangSmithRunChatLoader with untrusted data.

    Remediation

    • Upgrade LangChain to 0.3.81 or 1.2.5 or later.
    • Audit agent code for the vulnerable patterns above, and avoid deserializing untrusted data.
    • Assess AI systems holistically, treating agent workflows as full applications, in line with the OWASP Top 10 for Agentic Applications.
    • Test models against persona-based and social-pressure jailbreaks, not only technical prompt exploits.