aisentry Report

Generated: 2026-01-10 18:54:38 UTC

12
Combined Security Score
5
Vulnerability Score
19
Security Posture
2503
Files Scanned
324
Issues Found
62%
Confidence
14.8s
Scan Time

Vulnerabilities (324)

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/embeddings/base.py:429
Function '_tokenize' on line 429 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _tokenize( self, texts: list[str], chunk_size: int ) -> tuple[Iterable[int], list[list[int] | str], list[int], list[int]]: """Tokenize and batch input texts. Splits texts based on `embedding_ctx_length` and groups them into batches of size `chunk_size`. Args: texts: The list of texts to tokenize. chunk_size: The maximum number of texts to include in a single batch.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk network operation without confirmation in '_tokenize'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/embeddings/base.py:429
Function '_tokenize' on line 429 performs high-risk network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
raise ValueError(msg) def _tokenize( self, texts: list[str], chunk_size: int ) -> tuple[Iterable[int], list[list[int] | str], list[int], list[int]]: """Tokenize and batch input texts.
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:3754
Function '_construct_responses_api_payload' on line 3754 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _construct_responses_api_payload( messages: Sequence[BaseMessage], payload: dict ) -> dict: # Rename legacy parameters for legacy_token_param in ["max_tokens", "max_completion_tokens"]: if legacy_token_param in payload: payload["max_output_tokens"] = payload.pop(legacy_token_param) if "reasoning_effort" in payload and "reasoning" not in payload: payload["reasoning"] = {"effort": payload.pop("reasoning_effort")} # Remove temperature parameter for models that don't support it in responses API
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1338
Function '_generate' on line 1338 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _generate( self, messages: list[BaseMessage], stop: list[str] | None = None, run_manager: CallbackManagerForLLMRun | None = None, **kwargs: Any, ) -> ChatResult: self._ensure_sync_client_available() payload = self._get_request_payload(messages, stop=stop, **kwargs) generation_info = None raw_response = None
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1698
Function '_get_encoding_model' on line 1698 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_encoding_model(self) -> tuple[str, tiktoken.Encoding]: if self.tiktoken_model_name is not None: model = self.tiktoken_model_name else: model = self.model_name try: encoding = tiktoken.encoding_for_model(model) except KeyError: model_lower = model.lower() encoder = "cl100k_base"
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1714
Function 'get_token_ids' on line 1714 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def get_token_ids(self, text: str) -> list[int]: """Get the tokens present in the text with tiktoken package.""" if self.custom_get_token_ids is not None: return self.custom_get_token_ids(text) # tiktoken NOT supported for Python 3.7 or below if sys.version_info[1] <= 7: return super().get_token_ids(text) _, encoding_model = self._get_encoding_model() return encoding_model.encode(text) def get_num_tokens_from_messages(
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1724
Function 'get_num_tokens_from_messages' on line 1724 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def get_num_tokens_from_messages( self, messages: Sequence[BaseMessage], tools: Sequence[dict[str, Any] | type | Callable | BaseTool] | None = None, ) -> int: """Calculate num tokens for `gpt-3.5-turbo` and `gpt-4` with `tiktoken` package. !!! warning You must have the `pillow` installed if you want to count image tokens if you are specifying the image as a base64 string, and you must have both `pillow` and `httpx` installed if you are specifying the image as a URL. If
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk delete/write/network operation without confirmation in '_construct_responses_api_payload'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:3754
Function '_construct_responses_api_payload' on line 3754 performs high-risk delete/write/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def _construct_responses_api_payload( messages: Sequence[BaseMessage], payload: dict ) -> dict: # Rename legacy parameters
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk write/execute/network operation without confirmation in '_generate'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1338
Function '_generate' on line 1338 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
yield generation_chunk def _generate( self, messages: list[BaseMessage], stop: list[str] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk network operation without confirmation in 'get_num_tokens_from_messages'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1724
Function 'get_num_tokens_from_messages' on line 1724 performs high-risk network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return encoding_model.encode(text) def get_num_tokens_from_messages( self, messages: Sequence[BaseMessage], tools: Sequence[dict[str, Any] | type | Callable | BaseTool] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in '_construct_responses_api_payload'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:3754
Function '_construct_responses_api_payload' on line 3754 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def _construct_responses_api_payload( messages: Sequence[BaseMessage], payload: dict ) -> dict: # Rename legacy parameters
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Critical decision without oversight in 'get_num_tokens_from_messages'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1724
Function 'get_num_tokens_from_messages' on line 1724 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
return encoding_model.encode(text) def get_num_tokens_from_messages( self, messages: Sequence[BaseMessage], tools: Sequence[dict[str, Any] | type | Callable | BaseTool] | None = None,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:833
LLM output from '_convert_from_v1_to_ollama' is used in 'UPDATE' on line 833 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
update={ "content": _convert_from_v1_to_ollama( cast("list[types.ContentBlock]", message.content), message.response_metadata.get("model_provider"),
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:720
Function '_chat_params' on line 720 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _chat_params( self, messages: list[BaseMessage], stop: list[str] | None = None, **kwargs: Any, ) -> dict[str, Any]: """Assemble the parameters for a chat completion request. Args: messages: List of LangChain messages to send to the model. stop: Optional list of stop tokens to use for this invocation.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:812
Function '_convert_messages_to_ollama_messages' on line 812 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _convert_messages_to_ollama_messages( self, messages: list[BaseMessage] ) -> Sequence[Message]: """Convert a BaseMessage list to list of messages for Ollama to consume. Args: messages: List of BaseMessage to convert. Returns: List of messages in Ollama format. """
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:945
Function '_create_chat_stream' on line 945 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_chat_stream( self, messages: list[BaseMessage], stop: list[str] | None = None, **kwargs: Any, ) -> Iterator[Mapping[str, Any] | str]: chat_params = self._chat_params(messages, stop, **kwargs) if chat_params["stream"]: if self._client: yield from self._client.chat(**chat_params)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Code execution on external content
LLM05: Supply Chain Vulnerabilities HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:147
eval() on non-literal content on line 147.
# Use ast.literal_eval to safely parse Python-style dicts # (e.g. with single quotes) return ast.literal_eval(json_string) except (SyntaxError, ValueError) as e: # If both fail, and we're not skipping, raise an informative error. if skip:
Remediation
Secure Code Execution: 1. NEVER use eval/exec on untrusted input 2. Use safe alternatives (json.loads, ast.literal_eval) 3. Validate and sanitize all external content 4. Use sandboxed execution environments
High-risk network operation without confirmation in '_chat_params'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:720
Function '_chat_params' on line 720 performs high-risk network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
"""The async client to use for making requests.""" def _chat_params( self, messages: list[BaseMessage], stop: list[str] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk write/execute/network operation without confirmation in '_convert_messages_to_ollama_messages'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:812
Function '_convert_messages_to_ollama_messages' on line 812 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return self def _convert_messages_to_ollama_messages( self, messages: list[BaseMessage] ) -> Sequence[Message]: """Convert a BaseMessage list to list of messages for Ollama to consume.
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk write operation without confirmation in '_create_chat_stream'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:945
Function '_create_chat_stream' on line 945 performs high-risk write operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
yield await self._async_client.chat(**chat_params) def _create_chat_stream( self, messages: list[BaseMessage], stop: list[str] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in '_convert_messages_to_ollama_messages'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:812
Function '_convert_messages_to_ollama_messages' on line 812 makes critical security, data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
return self def _convert_messages_to_ollama_messages( self, messages: list[BaseMessage] ) -> Sequence[Message]: """Convert a BaseMessage list to list of messages for Ollama to consume.
Remediation
Critical security, data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Automated action without confidence threshold in '_create_chat_stream'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:945
Function '_create_chat_stream' on line 945 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
yield await self._async_client.chat(**chat_params) def _create_chat_stream( self, messages: list[BaseMessage], stop: list[str] | None = None,
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/llms.py:356
Function '_create_generate_stream' on line 356 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_generate_stream( self, prompt: str, stop: list[str] | None = None, **kwargs: Any, ) -> Iterator[Mapping[str, Any] | str]: if self._client: yield from self._client.generate( **self._generate_params(prompt, stop=stop, **kwargs) )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Automated action without confidence threshold in '_create_generate_stream'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/llms.py:356
Function '_create_generate_stream' on line 356 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
yield part def _create_generate_stream( self, prompt: str, stop: list[str] | None = None,
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
User input 'messages' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/huggingface/langchain_huggingface/chat_models/huggingface.py:752
User input 'messages' flows to LLM call via call in variable 'llm_input'. Function '_generate' may be vulnerable to prompt injection attacks.
return self._create_chat_result(answer) llm_input = self._to_chat_prompt(messages) if should_stream: stream_iter = self.llm._stream( llm_input, stop=stop, run_manager=run_manager, **kwargs
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/huggingface/langchain_huggingface/chat_models/huggingface.py:538
Function '_inherit_llm_properties' on line 538 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _inherit_llm_properties(self) -> None: """Inherit properties from the wrapped LLM instance if not explicitly set.""" if not hasattr(self, "llm") or self.llm is None: return # Map of ChatHuggingFace properties to LLM properties property_mappings = { "temperature": "temperature", "max_tokens": "max_new_tokens", # Different naming convention "top_p": "top_p", "seed": "seed",
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/huggingface/langchain_huggingface/chat_models/huggingface.py:723
Function '_generate' on line 723 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _generate( self, messages: list[BaseMessage], stop: list[str] | None = None, run_manager: CallbackManagerForLLMRun | None = None, stream: bool | None = None, # noqa: FBT001 **kwargs: Any, ) -> ChatResult: should_stream = stream if stream is not None else self.streaming if _is_huggingface_textgen_inference(self.llm):
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:410
Function '_format_messages' on line 410 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _format_messages( messages: Sequence[BaseMessage], ) -> tuple[str | list[dict] | None, list[dict]]: """Format messages for Anthropic's API.""" system: str | list[dict] | None = None formatted_messages: list[dict] = [] merged_messages = _merge_messages(messages) for _i, message in enumerate(merged_messages): if message.type == "system": if system is not None: msg = "Received multiple non-consecutive system messages."
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1792
Function 'convert_to_anthropic_tool' on line 1792 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def convert_to_anthropic_tool( tool: Mapping[str, Any] | type | Callable | BaseTool, *, strict: bool | None = None, ) -> AnthropicTool: """Convert a tool-like object to an Anthropic tool definition. Args: tool: A tool-like object to convert. Can be an Anthropic tool dict, a Pydantic model, a function, or a `BaseTool`. strict: If `True`, enables strict schema adherence for the tool.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1881
Function '_lc_tool_calls_to_anthropic_tool_use_blocks' on line 1881 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _lc_tool_calls_to_anthropic_tool_use_blocks( tool_calls: list[ToolCall], ) -> list[_AnthropicToolUse]: return [ _AnthropicToolUse( type="tool_use", name=tool_call["name"], input=tool_call["args"], id=cast("str", tool_call["id"]), ) for tool_call in tool_calls
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1004
Function '_client' on line 1004 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _client(self) -> anthropic.Client: client_params = self._client_params http_client_params = {"base_url": client_params["base_url"]} if "timeout" in client_params: http_client_params["timeout"] = client_params["timeout"] if self.anthropic_proxy: http_client_params["anthropic_proxy"] = self.anthropic_proxy http_client = _get_default_httpx_client(**http_client_params) params = { **client_params, "http_client": http_client,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1019
Function '_async_client' on line 1019 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _async_client(self) -> anthropic.AsyncClient: client_params = self._client_params http_client_params = {"base_url": client_params["base_url"]} if "timeout" in client_params: http_client_params["timeout"] = client_params["timeout"] if self.anthropic_proxy: http_client_params["anthropic_proxy"] = self.anthropic_proxy http_client = _get_default_async_httpx_client(**http_client_params) params = { **client_params, "http_client": http_client,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
LLM tool calling without permission checks in '_lc_tool_calls_to_anthropic_tool_use_blocks'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1885
Function '_lc_tool_calls_to_anthropic_tool_use_blocks' on line 1881 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
) -> list[_AnthropicToolUse]: return [ _AnthropicToolUse( type="tool_use", name=tool_call["name"], input=tool_call["args"],
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
LLM tool calling without permission checks in '_format_messages'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:489
Function '_format_messages' on line 410 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
else: args = {} tool_use_block = _AnthropicToolUse( type="tool_use", name=block["name"], input=args,
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
High-risk delete/execute/network operation without confirmation in '_format_messages'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:410
Function '_format_messages' on line 410 performs high-risk delete/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def _format_messages( messages: Sequence[BaseMessage], ) -> tuple[str | list[dict] | None, list[dict]]: """Format messages for Anthropic's API."""
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk network operation without confirmation in 'convert_to_anthropic_tool'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1792
Function 'convert_to_anthropic_tool' on line 1792 performs high-risk network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def convert_to_anthropic_tool( tool: Mapping[str, Any] | type | Callable | BaseTool, *, strict: bool | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk network operation without confirmation in '_lc_tool_calls_to_anthropic_tool_use_blocks'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1881
Function '_lc_tool_calls_to_anthropic_tool_use_blocks' on line 1881 performs high-risk network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def _lc_tool_calls_to_anthropic_tool_use_blocks( tool_calls: list[ToolCall], ) -> list[_AnthropicToolUse]: return [
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in '_format_messages'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:410
Function '_format_messages' on line 410 makes critical security, data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def _format_messages( messages: Sequence[BaseMessage], ) -> tuple[str | list[dict] | None, list[dict]]: """Format messages for Anthropic's API."""
Remediation
Critical security, data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/qdrant/langchain_qdrant/fastembed_sparse.py:70
Function 'embed_documents' on line 70 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def embed_documents(self, texts: list[str]) -> list[SparseVector]: results = self._model.embed( texts, batch_size=self._batch_size, parallel=self._parallel ) return [ SparseVector(indices=result.indices.tolist(), values=result.values.tolist()) for result in results ] def embed_query(self, text: str) -> SparseVector: result = next(self._model.query_embed(text))
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/qdrant/langchain_qdrant/fastembed_sparse.py:79
Function 'embed_query' on line 79 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def embed_query(self, text: str) -> SparseVector: result = next(self._model.query_embed(text)) return SparseVector( indices=result.indices.tolist(), values=result.values.tolist() )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:415
Function '_stream' on line 415 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _stream( self, messages: list[BaseMessage], stop: list[str] | None = None, run_manager: CallbackManagerForLLMRun | None = None, **kwargs: Any, ) -> Iterator[ChatGenerationChunk]: message_dicts, params = self._create_message_dicts(messages, stop) params = {**params, **kwargs} default_chunk_class = AIMessageChunk params.pop("stream", None)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:589
Function '_generate' on line 589 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _generate( self, messages: list[BaseMessage], stop: list[str] | None = None, run_manager: CallbackManagerForLLMRun | None = None, **kwargs: Any, ) -> ChatResult: if self.streaming: stream_iter = self._stream( messages, stop=stop, run_manager=run_manager, **kwargs )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write/execute operation without confirmation in '_stream'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:415
Function '_stream' on line 415 performs high-risk write/execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return default_class(content=content) # type: ignore[call-arg] def _stream( self, messages: list[BaseMessage], stop: list[str] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk write/execute operation without confirmation in '_generate'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:589
Function '_generate' on line 589 performs high-risk write/execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
yield chunk def _generate( self, messages: list[BaseMessage], stop: list[str] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:422
LLM output from 'beta_model.bind_tools' is used in 'UPDATE' on line 422 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
beta_model = self.model_copy(update={"api_base": DEFAULT_BETA_API_BASE}) return beta_model.bind_tools( tools, tool_choice=tool_choice,
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:528
LLM output from 'beta_model.with_structured_output' is used in 'UPDATE' on line 528 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
beta_model = self.model_copy(update={"api_base": DEFAULT_BETA_API_BASE}) return beta_model.with_structured_output( schema, method=method,
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:395
Function 'bind_tools' on line 395 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def bind_tools( self, tools: Sequence[dict[str, Any] | type | Callable | BaseTool], *, tool_choice: dict | str | bool | None = None, strict: bool | None = None, parallel_tool_calls: bool | None = None, **kwargs: Any, ) -> Runnable[LanguageModelInput, AIMessage]: """Bind tool-like objects to this chat model.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
LLM tool calling without permission checks in 'bind_tools'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:422
Function 'bind_tools' on line 395 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
# Create a new instance with beta endpoint beta_model = self.model_copy(update={"api_base": DEFAULT_BETA_API_BASE}) return beta_model.bind_tools( tools, tool_choice=tool_choice, strict=strict,
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
High-risk write/execute/network operation without confirmation in 'bind_tools'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:395
Function 'bind_tools' on line 395 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
) from e def bind_tools( self, tools: Sequence[dict[str, Any] | type | Callable | BaseTool], *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in 'bind_tools'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:395
Function 'bind_tools' on line 395 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
) from e def bind_tools( self, tools: Sequence[dict[str, Any] | type | Callable | BaseTool], *,
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Network fetch combined with code execution
LLM05: Supply Chain Vulnerabilities CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/groq/langchain_groq/chat_models.py:1383
This file downloads external content (lines [441]) and executes code (lines [1383, 1384, 1385]). This pattern enables remote code execution attacks if the fetched content is not properly validated.
return HumanMessageChunk(content=content) if role == "assistant" or default_class == AIMessageChunk: if reasoning := _dict.get("reasoning"): additional_kwargs["reasoning_content"] = reasoning if executed_tools := _dict.get("executed_tools"): additional_kwargs["executed_tools"] = [] for executed_tool in executed_tools: if executed_tool.get("output"): # Tool output duplicates query and other server tool call data additional_kwargs["executed_tools"].append(
Remediation
Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/prompty/langchain_prompty/core.py:191
Function '__call__' on line 191 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def __call__(self, data: BaseModel) -> BaseModel: return self.invoke(data) class NoOpParser(Invoker): """NoOp parser for invokers.""" def invoke(self, data: BaseModel) -> BaseModel: return data
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Network fetch combined with code execution
LLM05: Supply Chain Vulnerabilities CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/mistralai/langchain_mistralai/chat_models.py:86
This file downloads external content (lines [466, 616]) and executes code (lines [86]). This pattern enables remote code execution attacks if the fetched content is not properly validated.
logger = logging.getLogger(__name__) # Mistral enforces a specific pattern for tool call IDs TOOL_CALL_ID_PATTERN = re.compile(r"^[a-zA-Z0-9]{9}$") # This SSL context is equivalent to the default `verify=True`. # https://www.python-httpx.org/advanced/ssl/#configuring-client-instances global_ssl_context = ssl.create_default_context(cafile=certifi.where())
Remediation
Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments
Hardcoded Generic API Key detected in assignment
LLM06: Sensitive Information Disclosure HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/mistralai/langchain_mistralai/chat_models.py:120
Hardcoded Generic API Key found in assignment on line 120. Hardcoded secrets in source code pose a critical security risk as they can be extracted by anyone with access to the codebase, version control history, or compiled binaries.
def _base62_encode(num: int) -> str: """Encode a number in base62 and ensures result is of a specified length.""" base62 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ" if num == 0: return base62[0]
Remediation
Remove hardcoded secrets immediately: 1. Use environment variables: os.getenv('API_KEY') 2. Use secret management: AWS Secrets Manager, Azure Key Vault, HashiCorp Vault 3. Use configuration files (never commit to git): config.ini, .env 4. Rotate the exposed secret immediately 5. Scan git history for leaked secrets: git-secrets, truffleHog 6. Add secret scanning to CI/CD pipeline
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/embeddings/base.py:90
Function '_parse_model_string' on line 90 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _parse_model_string(model_name: str) -> tuple[str, str]: """Parse a model string into provider and model name components. The model string should be in the format 'provider:model-name', where provider is one of the supported providers. Args: model_name: A model string in the format 'provider:model-name' Returns: A tuple of (provider, model_name)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/embeddings/base.py:144
Function '_infer_model_and_provider' on line 144 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _infer_model_and_provider( model: str, *, provider: str | None = None, ) -> tuple[str, str]: if not model.strip(): msg = "Model name cannot be empty" raise ValueError(msg) if provider is None and ":" in model: provider, model_name = _parse_model_string(model) else:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/chat_models/base.py:701
User input parameter 'input' is directly passed to LLM API call 'self._model(config).invoke'. This is a high-confidence prompt injection vector.
) -> Any: return self._model(config).invoke(input, config=config, **kwargs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/chat_models/base.py:695
Function 'invoke' on line 695 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: LanguageModelInput, config: RunnableConfig | None = None, **kwargs: Any, ) -> Any: return self._model(config).invoke(input, config=config, **kwargs) @override async def ainvoke( self,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
User input 'request' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1108
User input 'request' flows to LLM call via assignment in variable 'messages'. Function '_execute_model_sync' may be vulnerable to prompt injection attacks.
model_, effective_response_format = _get_bound_model(request) messages = request.messages if request.system_message: messages = [request.system_message, *messages] output = model_.invoke(messages) if name:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:543
Function 'create_agent' on line 543 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_agent( model: str | BaseChatModel, tools: Sequence[BaseTool | Callable[..., Any] | dict[str, Any]] | None = None, *, system_prompt: str | SystemMessage | None = None, middleware: Sequence[AgentMiddleware[StateT_co, ContextT]] = (), response_format: ResponseFormat[ResponseT] | type[ResponseT] | dict[str, Any] | None = None, state_schema: type[AgentState[ResponseT]] | None = None, context_schema: type[ContextT] | None = None, checkpointer: Checkpointer | None = None, store: BaseStore | None = None,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:980
Function '_get_bound_model' on line 980 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_bound_model( request: ModelRequest, ) -> tuple[Runnable[Any, Any], ResponseFormat[Any] | None]: """Get the model with appropriate tool bindings. Performs auto-detection of strategy if needed based on model capabilities. Args: request: The model request containing model, tools, and response format. Returns:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1100
Function '_execute_model_sync' on line 1100 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _execute_model_sync(request: ModelRequest) -> ModelResponse: """Execute model and return response. This is the core model execution logic wrapped by `wrap_model_call` handlers. Raises any exceptions that occur during model invocation. """ # Get the bound model (with auto-detection if needed) model_, effective_response_format = _get_bound_model(request) messages = request.messages if request.system_message: messages = [request.system_message, *messages]
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Direct execution of LLM-generated code in 'create_agent'
LLM08: Excessive Agency CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:543
Function 'create_agent' on line 543 directly executes code generated or influenced by an LLM using exec()/eval() or subprocess. This creates a critical security risk where malicious or buggy LLM outputs can execute arbitrary code, potentially compromising the entire system.
return result def create_agent( model: str | BaseChatModel, tools: Sequence[BaseTool | Callable[..., Any] | dict[str, Any]] | None = None, *, system_prompt: str | SystemMessage | None = None, middleware: Sequence[AgentMiddleware[StateT_co, ContextT]] = (),
Remediation
Code Execution Security: 1. NEVER execute LLM-generated code directly with exec()/eval() 2. If code execution is necessary, use sandboxed environments (Docker, VM) 3. Implement strict code validation and static analysis before execution 4. Use allowlists for permitted functions/modules 5. Set resource limits (CPU, memory, time) for execution 6. Parse and validate code structure before running 7. Consider using safer alternatives (JSON, declarative configs) 8. Log all code execution attempts with full context 9. Require human review for generated code 10. Use tools like RestrictedPython for safer Python execution
High-risk execute/network operation without confirmation in '_execute_model_sync'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1100
Function '_execute_model_sync' on line 1100 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return request.model.bind(**request.model_settings), None def _execute_model_sync(request: ModelRequest) -> ModelResponse: """Execute model and return response. This is the core model execution logic wrapped by `wrap_model_call` handlers.
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Automated action without confidence threshold in '_execute_model_sync'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1100
Function '_execute_model_sync' on line 1100 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
return request.model.bind(**request.model_settings), None def _execute_model_sync(request: ModelRequest) -> ModelResponse: """Execute model and return response. This is the core model execution logic wrapped by `wrap_model_call` handlers.
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
User input 'request' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_emulator.py:134
User input 'request' flows to LLM call via f-string in variable 'prompt'. Function 'wrap_tool_call' may be vulnerable to prompt injection attacks.
# Extract tool information for emulation tool_args = request.tool_call["args"] tool_description = request.tool.description if request.tool else "No description available" # Build prompt for emulator LLM prompt = ( f"You are emulating a tool call for testing purposes.\n\n" f"Tool: {tool_name}\n" f"Description: {tool_description}\n" f"Arguments: {tool_args}\n\n" f"Generate a realistic response that this tool would return " f"given these arguments.\n" f"Return ONLY the tool's output, no explanation or preamble. " f"Introduce variation into your responses." ) # Get emulated response from LLM response = self.model.invoke([HumanMessage(prompt)])
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_emulator.py:150
LLM output from 'self.model.invoke' is used in 'call(' on line 150 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
# Get emulated response from LLM response = self.model.invoke([HumanMessage(prompt)]) # Short-circuit: return emulated result without executing real tool
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
User input 'request' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:288
User input 'request' flows to LLM call via call in variable 'selection_request'. Function 'wrap_model_call' may be vulnerable to prompt injection attacks.
""" selection_request = self._prepare_selection_request(request) if selection_request is None: return handler(request) # Create dynamic response model with Literal enum of available tool names type_adapter = _create_tool_selection_response(selection_request.available_tools) schema = type_adapter.json_schema() structured_model = selection_request.model.with_structured_output(schema) response = structured_model.invoke( [
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:295
LLM output from 'selection_request.model.with_structured_output' is used in 'SELECT' on line 295 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
schema = type_adapter.json_schema() structured_model = selection_request.model.with_structured_output(schema) response = structured_model.invoke(
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:297
LLM output from 'structured_model.invoke' is used in 'SELECT' on line 297 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
response = structured_model.invoke( [ {"role": "system", "content": selection_request.system_message},
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
Critical decision without oversight in 'wrap_model_call'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:270
Function 'wrap_model_call' on line 270 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
return request.override(tools=[*selected_tools, *provider_tools]) def wrap_model_call( self, request: ModelRequest, handler: Callable[[ModelRequest], ModelResponse],
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/summarization.py:562
Function '_create_summary' on line 562 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_summary(self, messages_to_summarize: list[AnyMessage]) -> str: """Generate summary for the given messages.""" if not messages_to_summarize: return "No previous conversation history." trimmed_messages = self._trim_messages_for_summary(messages_to_summarize) if not trimmed_messages: return "Previous conversation was too long to summarize." # Format messages to avoid token inflation from metadata when str() is called on # message objects
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Automated action without confidence threshold in '_create_summary'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/summarization.py:562
Function '_create_summary' on line 562 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
return idx def _create_summary(self, messages_to_summarize: list[AnyMessage]) -> str: """Generate summary for the given messages.""" if not messages_to_summarize: return "No previous conversation history."
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:245
LLM output from 'request.model.get_num_tokens_from_messages' is used in 'call(' on line 245 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
def count_tokens(messages: Sequence[BaseMessage]) -> int: return request.model.get_num_tokens_from_messages( system_msg + list(messages), request.tools )
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:218
Function 'wrap_model_call' on line 218 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def wrap_model_call( self, request: ModelRequest, handler: Callable[[ModelRequest], ModelResponse], ) -> ModelCallResult: """Apply context edits before invoking the model via handler. Args: request: Model request to execute (includes state and runtime). handler: Async callback that executes the model request and returns `ModelResponse`.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:244
Function 'count_tokens' on line 244 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def count_tokens(messages: Sequence[BaseMessage]) -> int: return request.model.get_num_tokens_from_messages( system_msg + list(messages), request.tools ) edited_messages = deepcopy(list(request.messages)) for edit in self.edits: edit.apply(edited_messages, count_tokens=count_tokens) return handler(request.override(messages=edited_messages))
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:281
Function 'count_tokens' on line 281 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def count_tokens(messages: Sequence[BaseMessage]) -> int: return request.model.get_num_tokens_from_messages( system_msg + list(messages), request.tools ) edited_messages = deepcopy(list(request.messages)) for edit in self.edits: edit.apply(edited_messages, count_tokens=count_tokens) return await handler(request.override(messages=edited_messages))
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'wrap_model_call'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:218
Function 'wrap_model_call' on line 218 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
self.token_count_method = token_count_method def wrap_model_call( self, request: ModelRequest, handler: Callable[[ModelRequest], ModelResponse],
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'count_tokens'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:244
Function 'count_tokens' on line 244 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
system_msg = [request.system_message] if request.system_message else [] def count_tokens(messages: Sequence[BaseMessage]) -> int: return request.model.get_num_tokens_from_messages( system_msg + list(messages), request.tools )
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'count_tokens'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:281
Function 'count_tokens' on line 281 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
system_msg = [request.system_message] if request.system_message else [] def count_tokens(messages: Sequence[BaseMessage]) -> int: return request.model.get_num_tokens_from_messages( system_msg + list(messages), request.tools )
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/contextual_compression.py:34
User input parameter 'query' is directly passed to LLM API call 'self.base_retriever.invoke'. This is a high-confidence prompt injection vector.
) -> list[Document]: docs = self.base_retriever.invoke( query,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/contextual_compression.py:27
Function '_get_relevant_documents' on line 27 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_relevant_documents( self, query: str, *, run_manager: CallbackManagerForRetrieverRun, **kwargs: Any, ) -> list[Document]: docs = self.base_retriever.invoke( query, config={"callbacks": run_manager.get_child()}, **kwargs,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in '_get_relevant_documents'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/contextual_compression.py:27
Function '_get_relevant_documents' on line 27 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def _get_relevant_documents( self, query: str, *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/merger_retriever.py:69
User input parameter 'query' is directly passed to LLM API call 'retriever.invoke'. This is a high-confidence prompt injection vector.
retriever_docs = [ retriever.invoke( query,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/merger_retriever.py:53
Function 'merge_documents' on line 53 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def merge_documents( self, query: str, run_manager: CallbackManagerForRetrieverRun, ) -> list[Document]: """Merge the results of the retrievers. Args: query: The query to search for. run_manager: The callback handler to use.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in 'merge_documents'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/merger_retriever.py:53
Function 'merge_documents' on line 53 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return await self.amerge_documents(query, run_manager) def merge_documents( self, query: str, run_manager: CallbackManagerForRetrieverRun,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/re_phraser.py:76
User input parameter 'query' is directly passed to LLM API call 'self.llm_chain.invoke'. This is a high-confidence prompt injection vector.
""" re_phrased_question = self.llm_chain.invoke( query,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/re_phraser.py:61
Function '_get_relevant_documents' on line 61 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_relevant_documents( self, query: str, *, run_manager: CallbackManagerForRetrieverRun, ) -> list[Document]: """Get relevant documents given a user question. Args: query: user question run_manager: callback handler to use
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in '_get_relevant_documents'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/re_phraser.py:61
Function '_get_relevant_documents' on line 61 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
) def _get_relevant_documents( self, query: str, *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/ensemble.py:224
User input parameter 'query' is directly passed to LLM API call 'retriever.invoke'. This is a high-confidence prompt injection vector.
retriever_docs = [ retriever.invoke( query,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/ensemble.py:202
Function 'rank_fusion' on line 202 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def rank_fusion( self, query: str, run_manager: CallbackManagerForRetrieverRun, *, config: RunnableConfig | None = None, ) -> list[Document]: """Rank fusion. Retrieve the results of the retrievers and use rank_fusion_func to get the final result.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in 'rank_fusion'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/ensemble.py:202
Function 'rank_fusion' on line 202 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return await self.arank_fusion(query, run_manager) def rank_fusion( self, query: str, run_manager: CallbackManagerForRetrieverRun,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:179
User input parameter 'query' is directly passed to LLM API call 'self.generate_queries'. This is a high-confidence prompt injection vector.
""" queries = self.generate_queries(query, run_manager) if self.include_original:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'question' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:199
User input parameter 'question' is directly passed to LLM API call 'self.llm_chain.invoke'. This is a high-confidence prompt injection vector.
""" response = self.llm_chain.invoke( {"question": question},
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:164
Function '_get_relevant_documents' on line 164 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_relevant_documents( self, query: str, *, run_manager: CallbackManagerForRetrieverRun, ) -> list[Document]: """Get relevant documents given a user query. Args: query: user query run_manager: the callback handler to use.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:185
Function 'generate_queries' on line 185 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def generate_queries( self, question: str, run_manager: CallbackManagerForRetrieverRun, ) -> list[str]: """Generate queries based upon user input. Args: question: user query run_manager: run manager for callbacks
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in '_get_relevant_documents'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:164
Function '_get_relevant_documents' on line 164 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return [doc for docs in document_lists for doc in docs] def _get_relevant_documents( self, query: str, *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'generate_queries'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:185
Function 'generate_queries' on line 185 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return self.unique_union(documents) def generate_queries( self, question: str, run_manager: CallbackManagerForRetrieverRun,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/embeddings/base.py:28
Function '_parse_model_string' on line 28 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _parse_model_string(model_name: str) -> tuple[str, str]: """Parse a model string into provider and model name components. The model string should be in the format 'provider:model-name', where provider is one of the supported providers. Args: model_name: A model string in the format 'provider:model-name' Returns: A tuple of (provider, model_name)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/embeddings/base.py:83
Function '_infer_model_and_provider' on line 83 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _infer_model_and_provider( model: str, *, provider: str | None = None, ) -> tuple[str, str]: if not model.strip(): msg = "Model name cannot be empty" raise ValueError(msg) if provider is None and ":" in model: provider, model_name = _parse_model_string(model) else:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/chat_memory.py:74
Function 'save_context' on line 74 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def save_context(self, inputs: dict[str, Any], outputs: dict[str, str]) -> None: """Save context from this conversation to buffer.""" input_str, output_str = self._get_input_output(inputs, outputs) self.chat_memory.add_messages( [ HumanMessage(content=input_str), AIMessage(content=output_str), ], ) async def asave_context(
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/chat_memory.py:98
Function 'clear' on line 98 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def clear(self) -> None: """Clear memory contents.""" self.chat_memory.clear() async def aclear(self) -> None: """Clear memory contents.""" await self.chat_memory.aclear()
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk network operation without confirmation in 'save_context'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/chat_memory.py:74
Function 'save_context' on line 74 performs high-risk network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return inputs[prompt_input_key], outputs[output_key] def save_context(self, inputs: dict[str, Any], outputs: dict[str, str]) -> None: """Save context from this conversation to buffer.""" input_str, output_str = self._get_input_output(inputs, outputs) self.chat_memory.add_messages(
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/summary_buffer.py:112
Function 'prune' on line 112 has 3 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def prune(self) -> None: """Prune buffer if it exceeds max token limit.""" buffer = self.chat_memory.messages curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer) if curr_buffer_length > self.max_token_limit: pruned_memory = [] while curr_buffer_length > self.max_token_limit: pruned_memory.append(buffer.pop(0)) curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer) self.moving_summary_buffer = self.predict_new_summary( pruned_memory,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in 'prune'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/summary_buffer.py:112
Function 'prune' on line 112 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
await self.aprune() def prune(self) -> None: """Prune buffer if it exceeds max token limit.""" buffer = self.chat_memory.messages curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer)
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Automated action without confidence threshold in 'prune'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/summary_buffer.py:112
Function 'prune' on line 112 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
await self.aprune() def prune(self) -> None: """Prune buffer if it exceeds max token limit.""" buffer = self.chat_memory.messages curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer)
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore_token_buffer_memory.py:145
Function 'save_context' on line 145 has 3 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def save_context(self, inputs: dict[str, Any], outputs: dict[str, str]) -> None: """Save context from this conversation to buffer. Pruned.""" BaseChatMemory.save_context(self, inputs, outputs) self._timestamps.append(datetime.now().astimezone()) # Prune buffer if it exceeds max token limit buffer = self.chat_memory.messages curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer) if curr_buffer_length > self.max_token_limit: while curr_buffer_length > self.max_token_limit: self._pop_and_store_interaction(buffer) curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'save_context'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore_token_buffer_memory.py:145
Function 'save_context' on line 145 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return {self.memory_key: messages} def save_context(self, inputs: dict[str, Any], outputs: dict[str, str]) -> None: """Save context from this conversation to buffer. Pruned.""" BaseChatMemory.save_context(self, inputs, outputs) self._timestamps.append(datetime.now().astimezone())
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore.py:73
User input 'inputs' flows to LLM call via assignment in variable 'query'. Function 'load_memory_variables' may be vulnerable to prompt injection attacks.
input_key = self._get_prompt_input_key(inputs) query = inputs[input_key] docs = self.retriever.invoke(query) return self._documents_to_memory_variables(docs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore.py:67
Function 'load_memory_variables' on line 67 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def load_memory_variables( self, inputs: dict[str, Any], ) -> dict[str, list[Document] | str]: """Return history buffer.""" input_key = self._get_prompt_input_key(inputs) query = inputs[input_key] docs = self.retriever.invoke(query) return self._documents_to_memory_variables(docs) async def aload_memory_variables(
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/entity.py:607
Function 'clear' on line 607 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def clear(self) -> None: """Clear memory contents.""" self.chat_memory.clear() self.entity_cache.clear() self.entity_store.clear()
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/token_buffer.py:61
Function 'save_context' on line 61 has 3 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def save_context(self, inputs: dict[str, Any], outputs: dict[str, str]) -> None: """Save context from this conversation to buffer. Pruned.""" super().save_context(inputs, outputs) # Prune buffer if it exceeds max token limit buffer = self.chat_memory.messages curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer) if curr_buffer_length > self.max_token_limit: pruned_memory = [] while curr_buffer_length > self.max_token_limit: pruned_memory.append(buffer.pop(0)) curr_buffer_length = self.llm.get_num_tokens_from_messages(buffer)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'save_context'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/token_buffer.py:61
Function 'save_context' on line 61 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return {self.memory_key: self.buffer} def save_context(self, inputs: dict[str, Any], outputs: dict[str, str]) -> None: """Save context from this conversation to buffer. Pruned.""" super().save_context(inputs, outputs) # Prune buffer if it exceeds max token limit
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chat_models/base.py:773
User input parameter 'input' is directly passed to LLM API call 'self._model(config).invoke'. This is a high-confidence prompt injection vector.
) -> Any: return self._model(config).invoke(input, config=config, **kwargs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chat_models/base.py:767
Function 'invoke' on line 767 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: LanguageModelInput, config: RunnableConfig | None = None, **kwargs: Any, ) -> Any: return self._model(config).invoke(input, config=config, **kwargs) @override async def ainvoke( self,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Dynamic tool/plugin loading
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/__init__.py:56
Dynamic tool calling without validation on line 56.
create_structured_chat_agent, ) from langchain_classic.agents.tool_calling_agent.base import create_tool_calling_agent from langchain_classic.agents.xml.base import XMLAgent, create_xml_agent if TYPE_CHECKING:
Remediation
Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution
Dynamic tool/plugin loading
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/__init__.py:154
Dynamic tool calling without validation on line 154.
"create_sql_agent", "create_structured_chat_agent", "create_tool_calling_agent", "create_vectorstore_agent", "create_vectorstore_router_agent", "create_xml_agent",
Remediation
Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:419
Function 'plan' on line 419 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None, **kwargs: Any, ) -> AgentAction | AgentFinish: """Based on past history and current inputs, decide what to do. Args: intermediate_steps: Steps the LLM has taken to date, along with the observations.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:531
Function 'plan' on line 531 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None, **kwargs: Any, ) -> list[AgentAction] | AgentFinish: """Based on past history and current inputs, decide what to do. Args: intermediate_steps: Steps the LLM has taken to date, along with the observations.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'plan'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:419
Function 'plan' on line 419 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return self.input_keys_arg def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'plan'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:531
Function 'plan' on line 531 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return self.input_keys_arg def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in 'plan'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:419
Function 'plan' on line 419 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
return self.input_keys_arg def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Critical decision without oversight in 'plan'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:531
Function 'plan' on line 531 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
return self.input_keys_arg def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
User input 'prompt_value' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:251
User input parameter 'prompt_value' is directly passed to LLM API call 'self.retry_chain.invoke'. This is a high-confidence prompt injection vector.
else: completion = self.retry_chain.invoke( {
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:117
LLM output from 'self.retry_chain.invoke' is used in 'run(' on line 117 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
if self.legacy and hasattr(self.retry_chain, "run"): completion = self.retry_chain.run( prompt=prompt_value.to_string(), completion=completion,
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:245
LLM output from 'self.retry_chain.invoke' is used in 'run(' on line 245 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
if self.legacy and hasattr(self.retry_chain, "run"): completion = self.retry_chain.run( prompt=prompt_value.to_string(), completion=completion,
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:97
Function 'parse_with_prompt' on line 97 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def parse_with_prompt(self, completion: str, prompt_value: PromptValue) -> T: """Parse the output of an LLM call using a wrapped parser. Args: completion: The chain completion to parse. prompt_value: The prompt to use to parse the completion. Returns: The parsed completion. """ retries = 0
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:234
Function 'parse_with_prompt' on line 234 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def parse_with_prompt(self, completion: str, prompt_value: PromptValue) -> T: retries = 0 while retries <= self.max_retries: try: return self.parser.parse(completion) except OutputParserException as e: if retries == self.max_retries: raise retries += 1 if self.legacy and hasattr(self.retry_chain, "run"):
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/fix.py:81
LLM output from 'self.retry_chain.invoke' is used in 'run(' on line 81 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
if self.legacy and hasattr(self.retry_chain, "run"): completion = self.retry_chain.run( instructions=self.parser.get_format_instructions(), completion=completion,
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/fix.py:70
Function 'parse' on line 70 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def parse(self, completion: str) -> T: retries = 0 while retries <= self.max_retries: try: return self.parser.parse(completion) except OutputParserException as e: if retries == self.max_retries: raise retries += 1 if self.legacy and hasattr(self.retry_chain, "run"):
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'parse'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/fix.py:70
Function 'parse' on line 70 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def parse(self, completion: str) -> T: retries = 0 while retries <= self.max_retries:
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/loading.py:115
Function 'load_evaluator' on line 115 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def load_evaluator( evaluator: EvaluatorType, *, llm: BaseLanguageModel | None = None, **kwargs: Any, ) -> Chain | StringEvaluator: """Load the requested evaluation chain specified by a string. Parameters ---------- evaluator : EvaluatorType
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Unpinned model version in API call
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/loading.py:168
Model ''gpt-4'' is used without version pinning on line 168. Unpinned models can change unexpectedly, introducing breaking changes, security vulnerabilities, or behavioral shifts. This file contains dynamic code execution patterns, increasing risk.
raise ImportError(msg) from e llm = llm or ChatOpenAI(model="gpt-4", seed=42, temperature=0) except Exception as e: msg = ( f"Evaluation with the {evaluator_cls} requires a "
Remediation
Supply Chain Security Best Practices: 1. Pin model versions explicitly (model='gpt-4-0613') 2. Use model registries with version control 3. Document model versions in requirements.txt or similar 4. Implement model versioning in CI/CD pipelines
High-risk write/execute/network operation without confirmation in 'load_evaluator'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/loading.py:115
Function 'load_evaluator' on line 115 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def load_evaluator( evaluator: EvaluatorType, *, llm: BaseLanguageModel | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/example_generator.py:9
Function 'generate_example' on line 9 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def generate_example( examples: list[dict], llm: BaseLanguageModel, prompt_template: PromptTemplate, ) -> str: """Return another example given a list of examples for a prompt.""" prompt = FewShotPromptTemplate( examples=examples, suffix=TEST_GEN_TEMPLATE_SUFFIX, input_variables=[], example_prompt=prompt_template,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:117
User input parameter 'inputs' is directly passed to LLM API call 'self.generate'. This is a high-confidence prompt injection vector.
) -> dict[str, str]: response = self.generate([inputs], run_manager=run_manager) return self.create_outputs(response)[0]
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input_list' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:241
User input parameter 'input_list' is directly passed to LLM API call 'self.generate'. This is a high-confidence prompt injection vector.
try: response = self.generate(input_list, run_manager=run_manager) except BaseException as e:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:112
Function '_call' on line 112 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, str]: response = self.generate([inputs], run_manager=run_manager) return self.create_outputs(response)[0] def generate( self, input_list: list[dict[str, Any]],
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:120
Function 'generate' on line 120 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def generate( self, input_list: list[dict[str, Any]], run_manager: CallbackManagerForChainRun | None = None, ) -> LLMResult: """Generate LLM result from inputs.""" prompts, stop = self.prep_prompts(input_list, run_manager=run_manager) callbacks = run_manager.get_child() if run_manager else None if isinstance(self.llm, BaseLanguageModel): return self.llm.generate_prompt( prompts,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:224
Function 'apply' on line 224 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def apply( self, input_list: list[dict[str, Any]], callbacks: Callbacks = None, ) -> list[dict[str, str]]: """Utilize the LLM generate method for speed gains.""" callback_manager = CallbackManager.configure( callbacks, self.callbacks, self.verbose, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write/execute/network operation without confirmation in '_call'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:112
Function '_call' on line 112 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return [self.output_key, "full_generation"] def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk write/execute/network operation without confirmation in 'apply'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:224
Function 'apply' on line 224 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return prompts, stop def apply( self, input_list: list[dict[str, Any]], callbacks: Callbacks = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Automated action without confidence threshold in 'apply'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:224
Function 'apply' on line 224 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
return prompts, stop def apply( self, input_list: list[dict[str, Any]], callbacks: Callbacks = None,
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:413
User input parameter 'inputs' is directly passed to LLM API call 'self.invoke'. This is a high-confidence prompt injection vector.
return self.invoke( inputs,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:413
LLM output from 'self.invoke' is used in 'call(' on line 413 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
return self.invoke( inputs, cast("RunnableConfig", {k: v for k, v in config.items() if v is not None}),
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:369
Function '__call__' on line 369 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def __call__( self, inputs: dict[str, Any] | Any, return_only_outputs: bool = False, # noqa: FBT001,FBT002 callbacks: Callbacks = None, *, tags: list[str] | None = None, metadata: dict[str, Any] | None = None, run_name: str | None = None, include_run_info: bool = False, ) -> dict[str, Any]:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '__call__'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:369
Function '__call__' on line 369 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@deprecated("0.1.0", alternative="invoke", removal="1.0") def __call__( self, inputs: dict[str, Any] | Any, return_only_outputs: bool = False, # noqa: FBT001,FBT002
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'question' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:67
User input parameter 'question' is directly passed to LLM API call 'chain.invoke'. This is a high-confidence prompt injection vector.
) return chain.invoke({chain.input_key: question})[chain.output_key]
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'question' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:137
User input parameter 'question' is directly passed to LLM API call 'chain.invoke'. This is a high-confidence prompt injection vector.
) return chain.invoke({chain.question_key: question})
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:34
Function 'query' on line 34 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def query( self, question: str, llm: BaseLanguageModel | None = None, retriever_kwargs: dict[str, Any] | None = None, **kwargs: Any, ) -> str: """Query the `VectorStore` using the provided LLM. Args: question: The question or prompt to query.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:104
Function 'query_with_sources' on line 104 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def query_with_sources( self, question: str, llm: BaseLanguageModel | None = None, retriever_kwargs: dict[str, Any] | None = None, **kwargs: Any, ) -> dict: """Query the `VectorStore` and retrieve the answer along with sources. Args: question: The question or prompt to query.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Critical decision without oversight in 'query'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:34
Function 'query' on line 34 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
) def query( self, question: str, llm: BaseLanguageModel | None = None,
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Critical decision without oversight in 'query_with_sources'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:104
Function 'query_with_sources' on line 104 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
return (await chain.ainvoke({chain.input_key: question}))[chain.output_key] def query_with_sources( self, question: str, llm: BaseLanguageModel | None = None,
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
User input 'text' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:81
User input parameter 'text' is directly passed to LLM API call 'self.llm_chain.invoke'. This is a high-confidence prompt injection vector.
var_name = self.input_keys[0] result = self.llm_chain.invoke({var_name: text}) if isinstance(self.llm_chain, LLMChain):
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:96
User input parameter 'inputs' is directly passed to LLM API call 'self.llm_chain.invoke'. This is a high-confidence prompt injection vector.
_run_manager = run_manager or CallbackManagerForChainRun.get_noop_manager() return self.llm_chain.invoke( inputs,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
LLM output used in dangerous command_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:81
LLM output from 'self.llm_chain.invoke' is used in 'call(' on line 81 without sanitization. This creates a command_injection vulnerability where malicious LLM output can compromise application security.
var_name = self.input_keys[0] result = self.llm_chain.invoke({var_name: text}) if isinstance(self.llm_chain, LLMChain): documents = [result[self.output_keys[0]]]
Remediation
Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:89
Function '_call' on line 89 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, str]: """Call the internal llm chain.""" _run_manager = run_manager or CallbackManagerForChainRun.get_noop_manager() return self.llm_chain.invoke( inputs, config={"callbacks": _run_manager.get_child()}, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_call'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:89
Function '_call' on line 89 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return self.combine_embeddings(embeddings) def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/elasticsearch_database/base.py:116
Function '_call' on line 116 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, Any]: _run_manager = run_manager or CallbackManagerForChainRun.get_noop_manager() input_text = f"{inputs[self.input_key]}\nESQuery:" _run_manager.on_text(input_text, verbose=self.verbose) indices = self._list_indices() indices_info = self._get_indices_infos(indices) query_inputs: dict = {
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Network fetch combined with code execution
LLM05: Supply Chain Vulnerabilities CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/openai_functions/openapi.py:98
This file downloads external content (lines [196]) and executes code (lines [98, 335, 344]). This pattern enables remote code execution attacks if the fetched content is not properly validated.
Args: spec: OpenAPI spec to convert. Returns: Tuple of the OpenAI functions JSON schema and a default function for executing a request based on the OpenAI function schema. """ try: from langchain_community.tools import APIOperation except ImportError as e:
Remediation
Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/openai_functions/citation_fuzzy_match.py:77
Function 'create_citation_fuzzy_match_runnable' on line 77 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_citation_fuzzy_match_runnable(llm: BaseChatModel) -> Runnable: """Create a citation fuzzy match Runnable. Example usage: ```python from langchain_classic.chains import create_citation_fuzzy_match_runnable from langchain_openai import ChatOpenAI model = ChatOpenAI(model="gpt-4o-mini")
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Automated action without confidence threshold in 'create_citation_fuzzy_match_runnable'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/openai_functions/citation_fuzzy_match.py:77
Function 'create_citation_fuzzy_match_runnable' on line 77 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
def create_citation_fuzzy_match_runnable(llm: BaseChatModel) -> Runnable: """Create a citation fuzzy match Runnable. Example usage:
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/sql_database/query.py:33
Function 'create_sql_query_chain' on line 33 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_sql_query_chain( llm: BaseLanguageModel, db: SQLDatabase, prompt: BasePromptTemplate | None = None, k: int = 5, *, get_col_comments: bool | None = None, ) -> Runnable[SQLInput | SQLInputWithTables | dict[str, Any], str]: r"""Create a chain that generates SQL queries. *Security Note*: This chain generates SQL queries for the given database.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Critical decision without oversight in 'create_sql_query_chain'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/sql_database/query.py:33
Function 'create_sql_query_chain' on line 33 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_sql_query_chain( llm: BaseLanguageModel, db: SQLDatabase, prompt: BasePromptTemplate | None = None,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:66
Function 'create_openai_fn_runnable' on line 66 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_openai_fn_runnable( functions: Sequence[dict[str, Any] | type[BaseModel] | Callable], llm: Runnable, prompt: BasePromptTemplate | None = None, *, enforce_single_function_usage: bool = True, output_parser: BaseOutputParser | BaseGenerationOutputParser | None = None, **llm_kwargs: Any, ) -> Runnable: """Create a runnable sequence that uses OpenAI functions.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:450
Function '_create_openai_tools_runnable' on line 450 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_openai_tools_runnable( tool: dict[str, Any] | type[BaseModel] | Callable, llm: Runnable, *, prompt: BasePromptTemplate | None, output_parser: BaseOutputParser | BaseGenerationOutputParser | None, enforce_tool_usage: bool, first_tool_only: bool, ) -> Runnable: oai_tool = convert_to_openai_tool(tool) llm_kwargs: dict[str, Any] = {"tools": [oai_tool]}
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:524
Function '_create_openai_json_runnable' on line 524 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_openai_json_runnable( output_schema: dict[str, Any] | type[BaseModel], llm: Runnable, prompt: BasePromptTemplate | None = None, *, output_parser: BaseOutputParser | BaseGenerationOutputParser | None = None, ) -> Runnable: if isinstance(output_schema, type) and is_basemodel_subclass(output_schema): output_parser = output_parser or PydanticOutputParser( pydantic_object=output_schema, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Automated action without confidence threshold in '_create_openai_tools_runnable'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:450
Function '_create_openai_tools_runnable' on line 450 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
def _create_openai_tools_runnable( tool: dict[str, Any] | type[BaseModel] | Callable, llm: Runnable, *,
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/retrieval_qa/base.py:268
Function '_get_docs' on line 268 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_docs( self, question: str, *, run_manager: CallbackManagerForChainRun, ) -> list[Document]: """Get docs.""" return self.retriever.invoke( question, config={"callbacks": run_manager.get_child()}, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in '_get_docs'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/retrieval_qa/base.py:268
Function '_get_docs' on line 268 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
retriever: BaseRetriever = Field(exclude=True) def _get_docs( self, question: str, *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_with_sources/retrieval.py:52
User input 'inputs' flows to LLM call via assignment in variable 'question'. Function '_get_docs' may be vulnerable to prompt injection attacks.
) -> list[Document]: question = inputs[self.question_key] docs = self.retriever.invoke( question,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_with_sources/retrieval.py:46
Function '_get_docs' on line 46 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_docs( self, inputs: dict[str, Any], *, run_manager: CallbackManagerForChainRun, ) -> list[Document]: question = inputs[self.question_key] docs = self.retriever.invoke( question, config={"callbacks": run_manager.get_child()}, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_get_docs'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_with_sources/retrieval.py:46
Function '_get_docs' on line 46 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return docs[:num_docs] def _get_docs( self, inputs: dict[str, Any], *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_generation/base.py:121
User input 'inputs' flows to LLM call via call in variable 'docs'. Function '_call' may be vulnerable to prompt injection attacks.
) -> dict[str, list]: docs = self.text_splitter.create_documents([inputs[self.input_key]]) results = self.llm_chain.generate( [{"text": d.page_content} for d in docs],
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_generation/base.py:116
Function '_call' on line 116 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, list]: docs = self.text_splitter.create_documents([inputs[self.input_key]]) results = self.llm_chain.generate( [{"text": d.page_content} for d in docs], run_manager=run_manager, ) qa = [json.loads(res[0].text) for res in results.generations]
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write/execute/network operation without confirmation in '_call'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_generation/base.py:116
Function '_call' on line 116 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return [self.output_key] def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/natbot/base.py:113
Function '_call' on line 113 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _call( self, inputs: dict[str, str], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, str]: _run_manager = run_manager or CallbackManagerForChainRun.get_noop_manager() url = inputs[self.input_url_key] browser_content = inputs[self.input_browser_content_key] llm_cmd = self.llm_chain.invoke( { "objective": self.objective,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_call'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/natbot/base.py:113
Function '_call' on line 113 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return [self.output_key] def _call( self, inputs: dict[str, str], run_manager: CallbackManagerForChainRun | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/conversational_retrieval/base.py:408
Function '_get_docs' on line 408 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_docs( self, question: str, inputs: dict[str, Any], *, run_manager: CallbackManagerForChainRun, ) -> list[Document]: """Get docs.""" docs = self.retriever.invoke( question, config={"callbacks": run_manager.get_child()},
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_get_docs'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/conversational_retrieval/base.py:408
Function '_get_docs' on line 408 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def _get_docs( self, question: str, inputs: dict[str, Any],
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'user_input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:147
User input parameter 'user_input' is directly passed to LLM API call 'self.response_chain.invoke'. This is a high-confidence prompt injection vector.
context = "\n\n".join(d.page_content for d in docs) result = self.response_chain.invoke( {
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:135
Function '_do_generation' on line 135 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _do_generation( self, questions: list[str], user_input: str, response: str, _run_manager: CallbackManagerForChainRun, ) -> tuple[str, bool]: callbacks = _run_manager.get_child() docs = [] for question in questions: docs.extend(self.retriever.invoke(question))
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:198
Function '_call' on line 198 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, Any]: _run_manager = run_manager or CallbackManagerForChainRun.get_noop_manager() user_input = inputs[self.input_keys[0]] response = ""
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:250
Function 'from_llm' on line 250 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def from_llm( cls, llm: BaseLanguageModel | None, max_generation_len: int = 32, **kwargs: Any, ) -> FlareChain: """Creates a FlareChain from a language model. Args: llm: Language model to use. max_generation_len: Maximum length of the generated response.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Code execution on external content
LLM05: Supply Chain Vulnerabilities HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:237
eval() on non-literal content on line 237.
continue marginal, finished = self._do_retrieval( low_confidence_spans, _run_manager, user_input,
Remediation
Secure Code Execution: 1. NEVER use eval/exec on untrusted input 2. Use safe alternatives (json.loads, ast.literal_eval) 3. Validate and sanitize all external content 4. Use sandboxed execution environments
Direct execution of LLM-generated code in '_call'
LLM08: Excessive Agency CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:198
Function '_call' on line 198 directly executes code generated or influenced by an LLM using exec()/eval() or subprocess. This creates a critical security risk where malicious or buggy LLM outputs can execute arbitrary code, potentially compromising the entire system.
end="\n", ) return self._do_generation(questions, user_input, response, _run_manager) def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None, ) -> dict[str, Any]: _run_manager = run_manager or CallbackManagerForChainRun.get_noop_manager()
Remediation
Code Execution Security: 1. NEVER execute LLM-generated code directly with exec()/eval() 2. If code execution is necessary, use sandboxed environments (Docker, VM) 3. Implement strict code validation and static analysis before execution 4. Use allowlists for permitted functions/modules 5. Set resource limits (CPU, memory, time) for execution 6. Parse and validate code structure before running 7. Consider using safer alternatives (JSON, declarative configs) 8. Log all code execution attempts with full context 9. Require human review for generated code 10. Use tools like RestrictedPython for safer Python execution High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in '_do_generation'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:135
Function '_do_generation' on line 135 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return ["response"] def _do_generation( self, questions: list[str], user_input: str,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Direct execution of LLM output in '_call'
LLM09: Overreliance CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:198
Function '_call' on line 198 directly executes LLM-generated code using eval(. This is extremely dangerous and allows arbitrary code execution.
return self._do_generation(questions, user_input, response, _run_manager) def _call( self, inputs: dict[str, Any], run_manager: CallbackManagerForChainRun | None = None,
Remediation
NEVER directly execute LLM-generated code: 1. Remove direct execution: - Do not use eval(), exec(), or os.system() - Avoid dynamic code execution - Use safer alternatives (allow-lists) 2. If code generation is required: - Generate code for review only - Require human approval before execution - Use sandboxing (containers, VMs) - Implement strict security policies 3. Use structured outputs: - Return data, not code - Use JSON schemas - Define clear interfaces 4. Add safeguards: - Static code analysis before execution - Whitelist allowed operations - Rate limiting and monitoring
Critical decision without oversight in 'from_llm'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:250
Function 'from_llm' on line 250 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
@classmethod def from_llm( cls, llm: BaseLanguageModel | None, max_generation_len: int = 32,
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/scoring/eval_chain.py:240
Function 'from_llm' on line 240 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def from_llm( cls, llm: BaseLanguageModel, *, prompt: PromptTemplate | None = None, criteria: CRITERIA_TYPE | str | None = None, normalize_by: float | None = None, **kwargs: Any, ) -> ScoreStringEvalChain: """Initialize the ScoreStringEvalChain from an LLM.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/comparison/eval_chain.py:240
Function 'from_llm' on line 240 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def from_llm( cls, llm: BaseLanguageModel, *, prompt: PromptTemplate | None = None, criteria: CRITERIA_TYPE | str | None = None, **kwargs: Any, ) -> PairwiseStringEvalChain: """Initialize the PairwiseStringEvalChain from an LLM. Args:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/self_ask_with_search/base.py:97
Function 'create_self_ask_with_search_agent' on line 97 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_self_ask_with_search_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: BasePromptTemplate, ) -> Runnable: """Create an agent that uses self-ask with search prompting. Args: llm: LLM to use as the agent. tools: List of tools. Should just be of length 1, with that tool having name `Intermediate Answer`
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Automated action without confidence threshold in 'create_self_ask_with_search_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/self_ask_with_search/base.py:97
Function 'create_self_ask_with_search_agent' on line 97 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
def create_self_ask_with_search_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: BasePromptTemplate,
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_tools/base.py:17
Function 'create_openai_tools_agent' on line 17 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_openai_tools_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate, strict: bool | None = None, # noqa: FBT001 ) -> Runnable: """Create an agent that uses OpenAI tools. Args: llm: LLM to use as the agent. tools: Tools this agent has access to.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
LLM tool calling without permission checks in 'create_openai_tools_agent'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_tools/base.py:100
Function 'create_openai_tools_agent' on line 17 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
raise ValueError(msg) llm_with_tools = llm.bind( tools=[convert_to_openai_tool(tool, strict=strict) for tool in tools], )
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
Critical decision without oversight in 'create_openai_tools_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_tools/base.py:17
Function 'create_openai_tools_agent' on line 17 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_openai_tools_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/agent_token_buffer_memory.py:75
Function 'save_context' on line 75 has 3 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def save_context(self, inputs: dict[str, Any], outputs: dict[str, Any]) -> None: """Save context from this conversation to buffer. Pruned. Args: inputs: Inputs to the agent. outputs: Outputs from the agent. """ input_str, output_str = self._get_input_output(inputs, outputs) self.chat_memory.add_messages(input_str) # type: ignore[arg-type] format_to_messages = ( format_to_tool_messages
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'save_context'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/agent_token_buffer_memory.py:75
Function 'save_context' on line 75 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return {self.memory_key: final_buffer} def save_context(self, inputs: dict[str, Any], outputs: dict[str, Any]) -> None: """Save context from this conversation to buffer. Pruned. Args:
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:125
LLM output from 'self.llm.invoke' is used in 'SELECT' on line 125 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
if with_functions: predicted_message = self.llm.invoke( messages, functions=self.functions,
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:287
Function 'create_openai_functions_agent' on line 287 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_openai_functions_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate, ) -> Runnable: """Create an agent that uses OpenAI function calling. Args: llm: LLM to use as the agent. Should work with OpenAI function calling, so either be an OpenAI model that supports that or a wrapper of a different model that adds in equivalent support.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:96
Function 'plan' on line 96 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None, with_functions: bool = True, # noqa: FBT001,FBT002 **kwargs: Any, ) -> AgentAction | AgentFinish: """Given input, decided what to do. Args: intermediate_steps: Steps the LLM has taken to date,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
LLM tool calling without permission checks in 'create_openai_functions_agent'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:372
Function 'create_openai_functions_agent' on line 287 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
) raise ValueError(msg) llm_with_tools = llm.bind(functions=[convert_to_openai_function(t) for t in tools]) return ( RunnablePassthrough.assign( agent_scratchpad=lambda x: format_to_openai_function_messages(
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
LLM tool calling without permission checks in 'plan'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:125
Function 'plan' on line 96 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
messages = prompt.to_messages() if with_functions: predicted_message = self.llm.invoke( messages, functions=self.functions, callbacks=callbacks,
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
Critical decision without oversight in 'create_openai_functions_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:287
Function 'create_openai_functions_agent' on line 287 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_openai_functions_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
LLM output used in dangerous sql_injection sink
LLM02: Insecure Output Handling CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_multi_agent/base.py:228
LLM output from 'self.llm.invoke' is used in 'SELECT' on line 228 without sanitization. This creates a sql_injection vulnerability where malicious LLM output can compromise application security.
messages = prompt.to_messages() predicted_message = self.llm.invoke( messages, functions=self.functions,
Remediation
Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_multi_agent/base.py:204
Function 'plan' on line 204 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def plan( self, intermediate_steps: list[tuple[AgentAction, str]], callbacks: Callbacks = None, **kwargs: Any, ) -> list[AgentAction] | AgentFinish: """Given input, decided what to do. Args: intermediate_steps: Steps the LLM has taken to date, along with observations.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
LLM tool calling without permission checks in 'plan'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_multi_agent/base.py:228
Function 'plan' on line 204 enables LLM tool/function calling without implementing permission checks or authorization. This allows the LLM to autonomously execute tools without human oversight, potentially performing unauthorized or harmful actions.
prompt = self.prompt.format_prompt(**full_inputs) messages = prompt.to_messages() predicted_message = self.llm.invoke( messages, functions=self.functions, callbacks=callbacks,
Remediation
Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:18
Function 'create_tool_calling_agent' on line 18 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_tool_calling_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate, *, message_formatter: MessageFormatter = format_to_tool_messages, ) -> Runnable: """Create an agent that uses tools. Args: llm: LLM to use as the agent.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Dynamic tool/plugin loading
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:18
Dynamic tool calling without validation on line 18.
def create_tool_calling_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate,
Remediation
Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution
Dynamic tool/plugin loading
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:44
Dynamic tool calling without validation on line 44.
from langchain_classic.agents import ( AgentExecutor, create_tool_calling_agent, tool, ) from langchain_anthropic import ChatAnthropic
Remediation
Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution
Dynamic tool/plugin loading
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:67
Dynamic tool calling without validation on line 67.
tools = [magic_function] agent = create_tool_calling_agent(model, tools, prompt) agent_executor = AgentExecutor(agent=agent, tools=tools, verbose=True) agent_executor.invoke({"input": "what is the value of magic_function(3)?"})
Remediation
Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution
Critical decision without oversight in 'create_tool_calling_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:18
Function 'create_tool_calling_agent' on line 18 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_tool_calling_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Critical decision without oversight in 'create_structured_chat_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/structured_chat/base.py:166
Function 'create_structured_chat_agent' on line 166 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_structured_chat_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/json_chat/base.py:14
Function 'create_json_chat_agent' on line 14 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_json_chat_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate, stop_sequence: bool | list[str] = True, # noqa: FBT001,FBT002 tools_renderer: ToolsRenderer = render_text_description, template_tool_response: str = TEMPLATE_TOOL_RESPONSE, ) -> Runnable: r"""Create an agent that uses JSON to format its logic, build for Chat Models. Args:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Critical decision without oversight in 'create_json_chat_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/json_chat/base.py:14
Function 'create_json_chat_agent' on line 14 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_json_chat_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: ChatPromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/xml/base.py:115
Function 'create_xml_agent' on line 115 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_xml_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: BasePromptTemplate, tools_renderer: ToolsRenderer = render_text_description, *, stop_sequence: bool | list[str] = True, ) -> Runnable: r"""Create an agent that uses XML to format its logic. Args:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Critical decision without oversight in 'create_xml_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/xml/base.py:115
Function 'create_xml_agent' on line 115 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_xml_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: BasePromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:74
Function '_get_openai_client' on line 74 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_openai_client() -> openai.OpenAI: try: import openai return openai.OpenAI() except ImportError as e: msg = "Unable to import openai, please install with `pip install openai`." raise ImportError(msg) from e except AttributeError as e: msg = ( "Please make sure you are using a v1.1-compatible version of openai. You "
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:90
Function '_get_openai_async_client' on line 90 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_openai_async_client() -> openai.AsyncOpenAI: try: import openai return openai.AsyncOpenAI() except ImportError as e: msg = "Unable to import openai, please install with `pip install openai`." raise ImportError(msg) from e except AttributeError as e: msg = ( "Please make sure you are using a v1.1-compatible version of openai. You "
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:589
Function '_get_response' on line 589 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_response(self, run: Any) -> Any: # TODO: Pagination if run.status == "completed": import openai major_version = int(openai.version.VERSION.split(".")[0]) minor_version = int(openai.version.VERSION.split(".")[1]) version_gte_1_14 = (major_version > 1) or ( major_version == 1 and minor_version >= 14 # noqa: PLR2004 )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_get_response'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:589
Function '_get_response' on line 589 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
) def _get_response(self, run: Any) -> Any: # TODO: Pagination if run.status == "completed":
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/react/agent.py:16
Function 'create_react_agent' on line 16 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_react_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: BasePromptTemplate, output_parser: AgentOutputParser | None = None, tools_renderer: ToolsRenderer = render_text_description, *, stop_sequence: bool | list[str] = True, ) -> Runnable: r"""Create an agent that uses ReAct prompting.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Critical decision without oversight in 'create_react_agent'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/react/agent.py:16
Function 'create_react_agent' on line 16 makes critical security decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def create_react_agent( llm: BaseLanguageModel, tools: Sequence[BaseTool], prompt: BasePromptTemplate,
Remediation
Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:861
Function '_run_llm' on line 861 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _run_llm( llm: BaseLanguageModel, inputs: dict[str, Any], callbacks: Callbacks, *, tags: list[str] | None = None, input_mapper: Callable[[dict], Any] | None = None, metadata: dict[str, Any] | None = None, ) -> str | BaseMessage: """Run the language model on the example.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:929
Function '_run_chain' on line 929 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _run_chain( chain: Chain | Runnable, inputs: dict[str, Any], callbacks: Callbacks, *, tags: list[str] | None = None, input_mapper: Callable[[dict], Any] | None = None, metadata: dict[str, Any] | None = None, ) -> dict | str: """Run a chain on inputs.""" inputs_ = inputs if input_mapper is None else input_mapper(inputs)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:1512
Function 'run_on_dataset' on line 1512 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def run_on_dataset( client: Client | None, dataset_name: str, llm_or_chain_factory: MODEL_OR_CHAIN_FACTORY, *, evaluation: smith_eval.RunEvalConfig | None = None, dataset_version: datetime | str | None = None, concurrency_level: int = 5, project_name: str | None = None, project_metadata: dict[str, Any] | None = None, verbose: bool = False,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Insecure tool function '_run_llm' executes dangerous operations
LLM07: Insecure Plugin Design HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:861
Tool function '_run_llm' on line 861 takes LLM output as a parameter and performs dangerous operations (file_access) without proper validation. Attackers can craft malicious LLM outputs to execute arbitrary commands, access files, or perform SQL injection.
## Sync Utilities def _run_llm( llm: BaseLanguageModel, inputs: dict[str, Any], callbacks: Callbacks, *, tags: list[str] | None = None,
Remediation
Secure Tool/Plugin Implementation: 1. NEVER execute shell commands from LLM output directly 2. Use allowlists for permitted commands/operations 3. Validate all file paths against allowed directories 4. Use parameterized queries - never raw SQL from LLM 5. Validate URLs against allowlist before HTTP requests 6. Implement strict input schemas (JSON Schema, Pydantic) 7. Add rate limiting and request throttling 8. Log all tool invocations for audit 9. Use principle of least privilege 10. Implement human-in-the-loop for destructive operations
High-risk execute/network operation without confirmation in '_run_chain'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:929
Function '_run_chain' on line 929 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def _run_chain( chain: Chain | Runnable, inputs: dict[str, Any], callbacks: Callbacks,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in '_run_llm'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:861
Function '_run_llm' on line 861 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def _run_llm( llm: BaseLanguageModel, inputs: dict[str, Any], callbacks: Callbacks,
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Critical decision without oversight in 'run_on_dataset'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:1512
Function 'run_on_dataset' on line 1512 makes critical security, data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def run_on_dataset( client: Client | None, dataset_name: str, llm_or_chain_factory: MODEL_OR_CHAIN_FACTORY,
Remediation
Critical security, data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
Automated action without confidence threshold in '_run_chain'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:929
Function '_run_chain' on line 929 automatically executes actions based on LLM output without checking confidence thresholds or validating output. No action edges detected - advisory only.
def _run_chain( chain: Chain | Runnable, inputs: dict[str, Any], callbacks: Callbacks,
Remediation
Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/listwise_rerank.py:95
User input parameter 'query' is directly passed to LLM API call 'self.reranker.invoke'. This is a high-confidence prompt injection vector.
"""Filter down documents based on their relevance to the query.""" results = self.reranker.invoke( {"documents": documents, "query": query},
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/listwise_rerank.py:88
Function 'compress_documents' on line 88 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def compress_documents( self, documents: Sequence[Document], query: str, callbacks: Callbacks | None = None, ) -> Sequence[Document]: """Filter down documents based on their relevance to the query.""" results = self.reranker.invoke( {"documents": documents, "query": query}, config={"callbacks": callbacks}, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/listwise_rerank.py:102
Function 'from_llm' on line 102 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def from_llm( cls, llm: BaseLanguageModel, *, prompt: BasePromptTemplate | None = None, **kwargs: Any, ) -> "LLMListwiseRerank": """Create a LLMListwiseRerank document compressor from a language model. Args: llm: The language model to use for filtering. **Must implement
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/cross_encoder_rerank.py:31
Function 'compress_documents' on line 31 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def compress_documents( self, documents: Sequence[Document], query: str, callbacks: Callbacks | None = None, ) -> Sequence[Document]: """Rerank documents using CrossEncoder. Args: documents: A sequence of documents to compress. query: The query to use for compressing the documents.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in 'compress_documents'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/cross_encoder_rerank.py:31
Function 'compress_documents' on line 31 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def compress_documents( self, documents: Sequence[Document], query: str,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/chain_extract.py:68
Function 'compress_documents' on line 68 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def compress_documents( self, documents: Sequence[Document], query: str, callbacks: Callbacks | None = None, ) -> Sequence[Document]: """Compress page content of raw documents.""" compressed_docs = [] for doc in documents: _input = self.get_input(query, doc) output_ = self.llm_chain.invoke(_input, config={"callbacks": callbacks})
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/self_query/base.py:316
User input parameter 'query' is directly passed to LLM API call 'self.query_constructor.invoke'. This is a high-confidence prompt injection vector.
) -> list[Document]: structured_query = self.query_constructor.invoke( {"query": query},
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/self_query/base.py:310
Function '_get_relevant_documents' on line 310 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _get_relevant_documents( self, query: str, *, run_manager: CallbackManagerForRetrieverRun, ) -> list[Document]: structured_query = self.query_constructor.invoke( {"query": query}, config={"callbacks": run_manager.get_child()}, ) if self.verbose:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute operation without confirmation in '_get_relevant_documents'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/self_query/base.py:310
Function '_get_relevant_documents' on line 310 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def _get_relevant_documents( self, query: str, *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:402
User input parameter 'input' is directly passed to LLM API call 'self.generate_prompt'. This is a high-confidence prompt injection vector.
"ChatGeneration", self.generate_prompt( [self._convert_input(input)],
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:492
User input parameter 'input' is directly passed to LLM API call 'self.invoke'. This is a high-confidence prompt injection vector.
"AIMessageChunk", self.invoke(input, config=config, stop=stop, **kwargs), )
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:389
Function 'invoke' on line 389 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: LanguageModelInput, config: RunnableConfig | None = None, *, stop: list[str] | None = None, **kwargs: Any, ) -> AIMessage: config = ensure_config(config) return cast( "AIMessage",
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:1113
Function 'generate_prompt' on line 1113 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def generate_prompt( self, prompts: list[PromptValue], stop: list[str] | None = None, callbacks: Callbacks = None, **kwargs: Any, ) -> LLMResult: prompt_messages = [p.to_messages() for p in prompts] return self.generate(prompt_messages, stop=stop, callbacks=callbacks, **kwargs) @override
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake.py:106
User input parameter 'input' is directly passed to LLM API call 'self.invoke'. This is a high-confidence prompt injection vector.
) -> Iterator[str]: result = self.invoke(input, config) for i_c, c in enumerate(result):
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake.py:98
Function 'stream' on line 98 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def stream( self, input: LanguageModelInput, config: RunnableConfig | None = None, *, stop: list[str] | None = None, **kwargs: Any, ) -> Iterator[str]: result = self.invoke(input, config) for i_c, c in enumerate(result): if self.sleep is not None:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'stream'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake.py:98
Function 'stream' on line 98 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def stream( self, input: LanguageModelInput, config: RunnableConfig | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:378
User input parameter 'input' is directly passed to LLM API call 'self.generate_prompt'. This is a high-confidence prompt injection vector.
return ( self.generate_prompt( [self._convert_input(input)],
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'inputs' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:431
User input parameter 'inputs' is directly passed to LLM API call 'self.generate_prompt'. This is a high-confidence prompt injection vector.
try: llm_result = self.generate_prompt( [self._convert_input(input_) for input_ in inputs],
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:518
User input parameter 'input' is directly passed to LLM API call 'self.invoke'. This is a high-confidence prompt injection vector.
# model doesn't implement streaming, so use default implementation yield self.invoke(input, config=config, stop=stop, **kwargs) else:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'prompts' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:788
User input 'prompts' flows to LLM call via assignment in variable 'prompt_strings'. Function 'generate_prompt' may be vulnerable to prompt injection attacks.
) -> LLMResult: prompt_strings = [p.to_string() for p in prompts] return self.generate(prompt_strings, stop=stop, callbacks=callbacks, **kwargs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:368
Function 'invoke' on line 368 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: LanguageModelInput, config: RunnableConfig | None = None, *, stop: list[str] | None = None, **kwargs: Any, ) -> str: config = ensure_config(config) return ( self.generate_prompt(
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:415
Function 'batch' on line 415 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def batch( self, inputs: list[LanguageModelInput], config: RunnableConfig | list[RunnableConfig] | None = None, *, return_exceptions: bool = False, **kwargs: Any, ) -> list[str]: if not inputs: return []
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:508
Function 'stream' on line 508 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def stream( self, input: LanguageModelInput, config: RunnableConfig | None = None, *, stop: list[str] | None = None, **kwargs: Any, ) -> Iterator[str]: if type(self)._stream == BaseLLM._stream: # noqa: SLF001 # model doesn't implement streaming, so use default implementation yield self.invoke(input, config=config, stop=stop, **kwargs)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:781
Function 'generate_prompt' on line 781 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def generate_prompt( self, prompts: list[PromptValue], stop: list[str] | None = None, callbacks: Callbacks | list[Callbacks] | None = None, **kwargs: Any, ) -> LLMResult: prompt_strings = [p.to_string() for p in prompts] return self.generate(prompt_strings, stop=stop, callbacks=callbacks, **kwargs) @override
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake_chat_models.py:158
Function 'batch' on line 158 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def batch( self, inputs: list[Any], config: RunnableConfig | list[RunnableConfig] | None = None, *, return_exceptions: bool = False, **kwargs: Any, ) -> list[AIMessage]: if isinstance(config, list): return [ self.invoke(m, c, **kwargs)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'batch'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake_chat_models.py:158
Function 'batch' on line 158 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override # manually override batch to preserve batch ordering with no concurrency def batch( self, inputs: list[Any], config: RunnableConfig | list[RunnableConfig] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:76
Function 'tool' on line 76 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def tool( name_or_callable: str | Callable | None = None, runnable: Runnable | None = None, *args: Any, description: str | None = None, return_direct: bool = False, args_schema: ArgsSchema | None = None, infer_schema: bool = True, response_format: Literal["content", "content_and_artifact"] = "content", parse_docstring: bool = False, error_on_invalid_docstring: bool = True,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:413
Function 'convert_runnable_to_tool' on line 413 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def convert_runnable_to_tool( runnable: Runnable, args_schema: type[BaseModel] | None = None, *, name: str | None = None, description: str | None = None, arg_types: dict[str, type] | None = None, ) -> BaseTool: """Convert a Runnable into a BaseTool. Args:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:253
Function '_create_tool_factory' on line 253 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_tool_factory( tool_name: str, ) -> Callable[[Callable | Runnable], BaseTool]: """Create a decorator that takes a callable and returns a tool. Args: tool_name: The name that will be assigned to the tool. Returns: A function that takes a callable or Runnable and returns a tool. """
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:450
Function 'invoke_wrapper' on line 450 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke_wrapper(callbacks: Callbacks | None = None, **kwargs: Any) -> Any: return runnable.invoke(kwargs, config={"callbacks": callbacks}) if ( arg_types is None and schema.get("type") == "object" and schema.get("properties") ): args_schema = runnable.input_schema else: args_schema = _get_schema_from_runnable_and_arg_types(
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:279
Function 'invoke_wrapper' on line 279 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke_wrapper( callbacks: Callbacks | None = None, **kwargs: Any ) -> Any: return runnable.invoke(kwargs, {"callbacks": callbacks}) coroutine = ainvoke_wrapper func = invoke_wrapper schema: ArgsSchema | None = runnable.input_schema tool_description = description or repr(runnable) elif inspect.iscoroutinefunction(dec_func): coroutine = dec_func
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write/execute/network operation without confirmation in 'tool'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:76
Function 'tool' on line 76 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def tool( name_or_callable: str | Callable | None = None, runnable: Runnable | None = None, *args: Any,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'convert_runnable_to_tool'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:413
Function 'convert_runnable_to_tool' on line 413 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def convert_runnable_to_tool( runnable: Runnable, args_schema: type[BaseModel] | None = None, *,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk write/execute/network operation without confirmation in '_create_tool_factory'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:253
Function '_create_tool_factory' on line 253 performs high-risk write/execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
""" # noqa: D214, D410, D411 # We're intentionally showing bad formatting in examples def _create_tool_factory( tool_name: str, ) -> Callable[[Callable | Runnable], BaseTool]: """Create a decorator that takes a callable and returns a tool.
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute operation without confirmation in 'invoke_wrapper'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:450
Function 'invoke_wrapper' on line 450 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return await runnable.ainvoke(kwargs, config={"callbacks": callbacks}) def invoke_wrapper(callbacks: Callbacks | None = None, **kwargs: Any) -> Any: return runnable.invoke(kwargs, config={"callbacks": callbacks}) if (
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute operation without confirmation in 'invoke_wrapper'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:279
Function 'invoke_wrapper' on line 279 performs high-risk execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return await runnable.ainvoke(kwargs, {"callbacks": callbacks}) def invoke_wrapper( callbacks: Callbacks | None = None, **kwargs: Any ) -> Any: return runnable.invoke(kwargs, {"callbacks": callbacks})
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'query' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/retriever.py:65
User input parameter 'query' is directly passed to LLM API call 'retriever.invoke'. This is a high-confidence prompt injection vector.
) -> str | tuple[str, list[Document]]: docs = retriever.invoke(query, config={"callbacks": callbacks}) content = document_separator.join(
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/retriever.py:31
Function 'create_retriever_tool' on line 31 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def create_retriever_tool( retriever: BaseRetriever, name: str, description: str, *, document_prompt: BasePromptTemplate | None = None, document_separator: str = "\n\n", response_format: Literal["content", "content_and_artifact"] = "content", ) -> StructuredTool: r"""Create a tool to do retrieval of documents.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/retriever.py:62
Function 'func' on line 62 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def func( query: str, callbacks: Callbacks = None ) -> str | tuple[str, list[Document]]: docs = retriever.invoke(query, config={"callbacks": callbacks}) content = document_separator.join( format_document(doc, document_prompt_) for doc in docs ) if response_format == "content_and_artifact": return (content, docs) return content
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/pydantic.py:231
Function '_create_subset_model_v2' on line 231 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _create_subset_model_v2( name: str, model: type[BaseModel], field_names: list[str], *, descriptions: dict | None = None, fn_description: str | None = None, ) -> type[BaseModel]: """Create a Pydantic model with a subset of the model fields.""" descriptions_ = descriptions or {} fields = {}
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write operation without confirmation in '_create_subset_model_v2'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/pydantic.py:231
Function '_create_subset_model_v2' on line 231 performs high-risk write operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def _create_subset_model_v2( name: str, model: type[BaseModel], field_names: list[str],
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/function_calling.py:193
Function '_convert_python_function_to_openai_function' on line 193 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _convert_python_function_to_openai_function( function: Callable, ) -> FunctionDescription: """Convert a Python function to an OpenAI function-calling API compatible dict. Assumes the Python function has type hints and a docstring with a description. If the docstring has Google Python style argument descriptions, these will be included as well. Args: function: The Python function to convert.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write operation without confirmation in '_convert_python_function_to_openai_function'
LLM08: Excessive Agency MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/function_calling.py:193
Function '_convert_python_function_to_openai_function' on line 193 performs high-risk write operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
def _convert_python_function_to_openai_function( function: Callable, ) -> FunctionDescription: """Convert a Python function to an OpenAI function-calling API compatible dict.
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Critical decision without oversight in '_convert_pydantic_to_openai_function'
LLM09: Overreliance INFO
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/function_calling.py:153
Function '_convert_pydantic_to_openai_function' on line 153 makes critical data_modification decisions based on LLM output without human oversight or verification. No action edges detected - advisory only.
def _convert_pydantic_to_openai_function( model: type, *, name: str | None = None,
Remediation
Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards
Network fetch combined with code execution
LLM05: Supply Chain Vulnerabilities CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/graph_mermaid.py:44
This file downloads external content (lines [456, 481]) and executes code (lines [44, 356, 363]). This pattern enables remote code execution attacks if the fetched content is not properly validated.
_HAS_PYPPETEER = False MARKDOWN_SPECIAL_CHARS = "*_`" _HEX_COLOR_PATTERN = re.compile(r"^#(?:[0-9a-fA-F]{3}){1,2}$") def draw_mermaid( nodes: dict[str, Node], edges: list[Edge],
Remediation
Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:189
User input parameter 'input_' is directly passed to LLM API call 'bound.invoke'. This is a high-confidence prompt injection vector.
else: return bound.invoke(input_, config, **kwargs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:185
User input parameter 'input_' is directly passed to LLM API call 'bound.invoke'. This is a high-confidence prompt injection vector.
try: return bound.invoke(input_, config, **kwargs) except Exception as e:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:142
Function 'invoke' on line 142 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: runnable, config = self.prepare(config) return runnable.invoke(input, config, **kwargs) @override async def ainvoke( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: runnable, config = self.prepare(config)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:156
Function 'batch' on line 156 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def batch( self, inputs: list[Input], config: RunnableConfig | list[RunnableConfig] | None = None, *, return_exceptions: bool = False, **kwargs: Any | None, ) -> list[Output]: configs = get_config_list(config, len(inputs)) prepared = [self.prepare(c) for c in configs]
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:178
Function 'invoke' on line 178 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( prepared: tuple[Runnable[Input, Output], RunnableConfig], input_: Input, ) -> Output | Exception: bound, config = prepared if return_exceptions: try: return bound.invoke(input_, config, **kwargs) except Exception as e: return e else:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:142
Function 'invoke' on line 142 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def invoke( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: runnable, config = self.prepare(config)
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'batch'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:156
Function 'batch' on line 156 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def batch( self, inputs: list[Input], config: RunnableConfig | list[RunnableConfig] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:178
Function 'invoke' on line 178 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return [] def invoke( prepared: tuple[Runnable[Input, Output], RunnableConfig], input_: Input, ) -> Output | Exception:
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:215
User input parameter 'input' is directly passed to LLM API call 'condition.invoke'. This is a high-confidence prompt injection vector.
expression_value = condition.invoke( input,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:234
User input parameter 'input' is directly passed to LLM API call 'self.default.invoke'. This is a high-confidence prompt injection vector.
else: output = self.default.invoke( input,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:224
User input parameter 'input' is directly passed to LLM API call 'runnable.invoke'. This is a high-confidence prompt injection vector.
if expression_value: output = runnable.invoke( input,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:327
User input parameter 'input' is directly passed to LLM API call 'condition.invoke'. This is a high-confidence prompt injection vector.
expression_value = condition.invoke( input,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:189
Function 'invoke' on line 189 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: """First evaluates the condition, then delegate to `True` or `False` branch. Args: input: The input to the `Runnable`. config: The configuration for the `Runnable`. **kwargs: Additional keyword arguments to pass to the `Runnable`. Returns:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:296
Function 'stream' on line 296 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def stream( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any | None, ) -> Iterator[Output]: """First evaluates the condition, then delegate to `True` or `False` branch. Args: input: The input to the `Runnable`. config: The configuration for the `Runnable`.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:189
Function 'invoke' on line 189 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def invoke( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: """First evaluates the condition, then delegate to `True` or `False` branch.
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'stream'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:296
Function 'stream' on line 296 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def stream( self, input: Input, config: RunnableConfig | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/retry.py:188
User input parameter 'input_' is directly passed to LLM API call 'super().invoke'. This is a high-confidence prompt injection vector.
with attempt: result = super().invoke( input_,
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/retry.py:179
Function '_invoke' on line 179 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _invoke( self, input_: Input, run_manager: "CallbackManagerForChainRun", config: RunnableConfig, **kwargs: Any, ) -> Output: for attempt in self._sync_retrying(reraise=True): with attempt: result = super().invoke( input_,
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/retry.py:179
Function '_invoke' on line 179 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
] def _invoke( self, input_: Input, run_manager: "CallbackManagerForChainRun",
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:162
User input parameter 'input_' is directly passed to LLM API call 'runnable.invoke'. This is a high-confidence prompt injection vector.
else: return runnable.invoke(input_, config, **kwargs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:158
User input parameter 'input_' is directly passed to LLM API call 'runnable.invoke'. This is a high-confidence prompt injection vector.
try: return runnable.invoke(input_, config, **kwargs) except Exception as e:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:107
Function 'invoke' on line 107 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: RouterInput, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: key = input["key"] actual_input = input["input"] if key not in self.runnables: msg = f"No runnable associated with key '{key}'" raise ValueError(msg) runnable = self.runnables[key] return runnable.invoke(actual_input, config)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:136
Function 'batch' on line 136 has 4 DoS risk(s): No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def batch( self, inputs: list[RouterInput], config: RunnableConfig | list[RunnableConfig] | None = None, *, return_exceptions: bool = False, **kwargs: Any | None, ) -> list[Output]: if not inputs: return []
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:153
Function 'invoke' on line 153 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( runnable: Runnable[Input, Output], input_: Input, config: RunnableConfig ) -> Output | Exception: if return_exceptions: try: return runnable.invoke(input_, config, **kwargs) except Exception as e: return e else: return runnable.invoke(input_, config, **kwargs)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:107
Function 'invoke' on line 107 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def invoke( self, input: RouterInput, config: RunnableConfig | None = None, **kwargs: Any ) -> Output: key = input["key"]
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'batch'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:136
Function 'batch' on line 136 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def batch( self, inputs: list[RouterInput], config: RunnableConfig | list[RunnableConfig] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:153
Function 'invoke' on line 153 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
raise ValueError(msg) def invoke( runnable: Runnable[Input, Output], input_: Input, config: RunnableConfig ) -> Output | Exception: if return_exceptions:
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/passthrough.py:480
Function '_invoke' on line 480 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _invoke( self, value: dict[str, Any], run_manager: CallbackManagerForChainRun, config: RunnableConfig, **kwargs: Any, ) -> dict[str, Any]: if not isinstance(value, dict): msg = "The input to RunnablePassthrough.assign() must be a dict." raise ValueError(msg) # noqa: TRY004
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in '_invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/passthrough.py:480
Function '_invoke' on line 480 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return graph def _invoke( self, value: dict[str, Any], run_manager: CallbackManagerForChainRun,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:979
User input parameter 'input_' is directly passed to LLM API call 'self.invoke'. This is a high-confidence prompt injection vector.
else: out = self.invoke(input_, config, **kwargs)
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
User input 'input_' embedded in LLM prompt
LLM01: Prompt Injection CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:975
User input parameter 'input_' is directly passed to LLM API call 'self.invoke'. This is a high-confidence prompt injection vector.
try: out: Output | Exception = self.invoke(input_, config, **kwargs) except Exception as e:
Remediation
Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:867
Function 'batch' on line 867 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def batch( self, inputs: list[Input], config: RunnableConfig | list[RunnableConfig] | None = None, *, return_exceptions: bool = False, **kwargs: Any | None, ) -> list[Output]: """Default implementation runs invoke in parallel using a thread pool executor. The default implementation of batch works well for IO bound runnables.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:937
Function 'batch_as_completed' on line 937 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def batch_as_completed( self, inputs: Sequence[Input], config: RunnableConfig | Sequence[RunnableConfig] | None = None, *, return_exceptions: bool = False, **kwargs: Any | None, ) -> Iterator[tuple[int, Output | Exception]]: """Run `invoke` in parallel on a list of inputs. Yields results as they complete.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:1130
Function 'stream' on line 1130 has 5 DoS risk(s): No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def stream( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any | None, ) -> Iterator[Output]: """Default implementation of `stream`, which calls `invoke`. Subclasses must override this method if they support streaming output. Args:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:4847
Function '_invoke' on line 4847 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def _invoke( self, input_: Input, run_manager: CallbackManagerForChainRun, config: RunnableConfig, **kwargs: Any, ) -> Output: if inspect.isgeneratorfunction(self.func): output: Output | None = None for chunk in call_func_with_variable_args( cast("Callable[[Input], Iterator[Output]]", self.func),
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:5685
Function 'invoke' on line 5685 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( self, input: Input, config: RunnableConfig | None = None, **kwargs: Any | None, ) -> Output: return self.bound.invoke( input, self._merge_configs(config), **{**self.kwargs, **kwargs}, )
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:901
Function 'invoke' on line 901 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke(input_: Input, config: RunnableConfig) -> Output | Exception: if return_exceptions: try: return self.invoke(input_, config, **kwargs) except Exception as e: return e else: return self.invoke(input_, config, **kwargs) # If there's only one input, don't bother with the executor if len(inputs) == 1:
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits
LLM04: Model Denial of Service CRITICAL
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:970
Function 'invoke' on line 970 has 4 DoS risk(s): No rate limiting, No input length validation, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def invoke( i: int, input_: Input, config: RunnableConfig ) -> tuple[int, Output | Exception]: if return_exceptions: try: out: Output | Exception = self.invoke(input_, config, **kwargs) except Exception as e: out = e else: out = self.invoke(input_, config, **kwargs)
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk execute/network operation without confirmation in 'batch'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:867
Function 'batch' on line 867 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return await run_in_executor(config, self.invoke, input, config, **kwargs) def batch( self, inputs: list[Input], config: RunnableConfig | list[RunnableConfig] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'batch_as_completed'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:937
Function 'batch_as_completed' on line 937 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
) -> Iterator[tuple[int, Output | Exception]]: ... def batch_as_completed( self, inputs: Sequence[Input], config: RunnableConfig | Sequence[RunnableConfig] | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'stream'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:1130
Function 'stream' on line 1130 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
yield await coro def stream( self, input: Input, config: RunnableConfig | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in '_invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:4847
Function '_invoke' on line 4847 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
return self._repr def _invoke( self, input_: Input, run_manager: CallbackManagerForChainRun,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:5685
Function 'invoke' on line 5685 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
@override def invoke( self, input: Input, config: RunnableConfig | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:901
Function 'invoke' on line 901 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
configs = get_config_list(config, len(inputs)) def invoke(input_: Input, config: RunnableConfig) -> Output | Exception: if return_exceptions: try: return self.invoke(input_, config, **kwargs)
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
High-risk execute/network operation without confirmation in 'invoke'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:970
Function 'invoke' on line 970 performs high-risk execute/network operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
configs = get_config_list(config, len(inputs)) def invoke( i: int, input_: Input, config: RunnableConfig ) -> tuple[int, Output | Exception]: if return_exceptions:
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
Code execution on external content
LLM05: Supply Chain Vulnerabilities MEDIUM
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/documents/base.py:7
eval() on non-literal content on line 7.
- `BaseMedia`: Base class providing `id` and `metadata` fields - `Blob`: Raw data loading (files, binary data) - used by document loaders - `Document`: Text content for retrieval (RAG, vector stores, semantic search) !!! note "Not for LLM chat messages" These classes are for data processing pipelines, not LLM I/O. For multimodal
Remediation
Secure Code Execution: 1. NEVER use eval/exec on untrusted input 2. Use safe alternatives (json.loads, ast.literal_eval) 3. Validate and sanitize all external content 4. Use sandboxed execution environments
Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits
LLM04: Model Denial of Service HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tracers/evaluation.py:64
Function '__init__' on line 64 has 3 DoS risk(s): No rate limiting, No timeout configuration, No token/context limits. These missing protections enable attackers to exhaust model resources through excessive requests, large inputs, or recursive calls, leading to service degradation or unavailability.
def __init__( self, evaluators: Sequence[langsmith.RunEvaluator], client: langsmith.Client | None = None, example_id: UUID | str | None = None, skip_unfinished: bool = True, # noqa: FBT001,FBT002 project_name: str | None = "evaluators", max_concurrency: int | None = None, **kwargs: Any, ) -> None: """Create an EvaluatorCallbackHandler.
Remediation
Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets
High-risk write/execute operation without confirmation in '__init__'
LLM08: Excessive Agency HIGH
/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tracers/evaluation.py:64
Function '__init__' on line 64 performs high-risk write/execute operations based on LLM decisions without requiring user confirmation or approval. This allows the LLM to autonomously execute potentially destructive or sensitive actions.
lock: threading.Lock def __init__( self, evaluators: Sequence[langsmith.RunEvaluator], client: langsmith.Client | None = None,
Remediation
High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits
19
Overall Score
Initial
25
Controls Detected
of 61
2660
Files Analyzed
386
Total Recommendations

Category Scores

Prompt Security
28/100
  • Prompt Sanitization Advanced
  • Rate Limiting Missing
  • Input Validation Advanced
  • Output Filtering Advanced
  • Context Window Protection Missing
  • Red Team Testing Missing
  • Prompt Anomaly Detection Missing
  • System Prompt Protection Missing
3 Detected 0 Partial 5 Missing
Model Security
25/100
  • Access Control Missing
  • Model Versioning Missing
  • Dependency Scanning Missing
  • API Security Missing
  • Model Source Verification Advanced
  • Differential Privacy Intermediate
  • Model Watermarking Missing
  • Secure Model Loading Advanced
3 Detected 0 Partial 5 Missing
Data Privacy
31/100
  • PII Detection Intermediate
  • Data Redaction Advanced
  • Data Encryption Intermediate
  • Audit Logging Advanced
  • Consent Management Missing
  • NER PII Detection Missing
  • Data Retention Policy Missing
  • GDPR Compliance Missing
4 Detected 0 Partial 4 Missing
OWASP LLM Top 10
45/100
  • LLM01: Prompt Injection Defense Advanced
  • LLM02: Insecure Output Handling Intermediate
  • LLM03: Training Data Poisoning Partial
  • LLM04: Model Denial of Service Missing
  • LLM05: Supply Chain Vulnerabilities Intermediate
  • LLM06: Sensitive Information Disclosure Advanced
  • LLM07: Insecure Plugin Design Advanced
  • LLM08: Excessive Agency Partial
  • LLM09: Overreliance Advanced
  • LLM10: Model Theft Missing
6 Detected 2 Partial 2 Missing
Blue Team Operations
21/100
  • Model Monitoring Advanced
  • Drift Detection Missing
  • Anomaly Detection Missing
  • Adversarial Attack Detection Missing
  • AI Incident Response Missing
  • Model Drift Monitoring Missing
  • Data Quality Monitoring Advanced
2 Detected 0 Partial 5 Missing
AI Governance
0/100
  • Model Explainability Missing
  • Bias Detection Missing
  • Model Documentation Missing
  • Compliance Tracking Missing
  • Human Oversight Missing
0 Detected 0 Partial 5 Missing
Supply Chain Security
25/100
  • Dependency Scanning Missing
  • Model Provenance Tracking Missing
  • Model Integrity Verification Advanced
1 Detected 0 Partial 2 Missing
Hallucination Mitigation
35/100
  • RAG Implementation Advanced
  • Confidence Scoring Missing
  • Source Attribution Intermediate
  • Temperature Control Missing
  • Fact Checking Intermediate
3 Detected 0 Partial 2 Missing
Ethical AI & Bias
12/100
  • Fairness Metrics Missing
  • Model Explainability Intermediate
  • Bias Testing Missing
  • Model Cards Missing
1 Detected 0 Partial 3 Missing
Incident Response
0/100
  • Monitoring Integration Missing
  • Audit Logging Missing
  • Rollback Capability Missing
0 Detected 0 Partial 3 Missing

All Recommendations (386)

Rate Limiting
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Context Window Protection
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Red Team Testing
Audit critical

Detection failed: 'ConfigAnalyzer' object has no attribute 'file_exists'

Prompt Anomaly Detection
Audit critical

Implement statistical analysis on prompt patterns

Prompt Anomaly Detection
Audit critical

Use ML-based anomaly detection for unusual inputs

Prompt Anomaly Detection
Audit critical

Set up alerts for prompt anomaly detection

System Prompt Protection
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Access Control
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Model Versioning
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Dependency Scanning
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

API Security
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Model Watermarking
Audit critical

Implement watermarking for model outputs

Model Watermarking
Audit critical

Use cryptographic watermarks for model weights

Model Watermarking
Audit critical

Track watermark verification for model theft detection

Consent Management
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

NER PII Detection
Audit critical

Use Presidio or SpaCy for NER-based PII detection

NER PII Detection
Audit critical

Implement custom NER models for domain-specific PII

NER PII Detection
Audit critical

Run PII detection on all inputs and outputs

Data Retention Policy
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

GDPR Compliance
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

LLM04: Model Denial of Service
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

LLM10: Model Theft
Audit critical

Implement rate limiting on API endpoints

LLM10: Model Theft
Audit critical

Add query logging and anomaly detection

LLM10: Model Theft
Audit critical

Monitor for extraction patterns

Drift Detection
Audit critical

Implement drift detection with evidently or alibi-detect

Drift Detection
Audit critical

Monitor input data distribution changes

Drift Detection
Audit critical

Set up automated alerts for drift events

Anomaly Detection
Audit critical

Implement anomaly detection on model inputs

Anomaly Detection
Audit critical

Monitor for unusual query patterns

Anomaly Detection
Audit critical

Use statistical methods or ML-based detection

Adversarial Attack Detection
Audit critical

Implement adversarial input detection

Adversarial Attack Detection
Audit critical

Use adversarial robustness toolkits

Adversarial Attack Detection
Audit critical

Add input perturbation analysis

AI Incident Response
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Model Drift Monitoring
Audit critical

Use Evidently or alibi-detect for drift monitoring

Model Drift Monitoring
Audit critical

Set up automated alerts for significant drift

Model Drift Monitoring
Audit critical

Implement automatic retraining pipelines

Model Explainability
Audit critical

Use SHAP or LIME for model explanations

Model Explainability
Audit critical

Provide decision explanations in outputs

Model Explainability
Audit critical

Implement feature attribution tracking

Bias Detection
Audit critical

Use Fairlearn or AIF360 for bias detection

Bias Detection
Audit critical

Implement fairness metrics tracking

Bias Detection
Audit critical

Test for demographic parity and equalized odds

Model Documentation
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Compliance Tracking
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Human Oversight
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Dependency Scanning
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Model Provenance Tracking
Audit critical

Use MLflow, DVC, or Weights & Biases for model tracking

Model Provenance Tracking
Audit critical

Implement model versioning with metadata

Model Provenance Tracking
Audit critical

Maintain model registry with provenance information

Confidence Scoring
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Temperature Control
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Fairness Metrics
Audit critical

Use Fairlearn or AIF360 for fairness metrics

Fairness Metrics
Audit critical

Implement demographic parity testing

Fairness Metrics
Audit critical

Monitor fairness metrics in production

Bias Testing
Audit critical

Implement adversarial testing for bias

Bias Testing
Audit critical

Test across demographic groups

Bias Testing
Audit critical

Use TextAttack or CheckList for NLP bias testing

Model Cards
Audit critical

Detection failed: 'ConfigAnalyzer' object has no attribute 'file_exists'

Monitoring Integration
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Audit Logging
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Rollback Capability
Audit critical

Detection failed: 'bool' object has no attribute 'lower'

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/embeddings/base.py:429
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:3754
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1338
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1714
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:833
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:720
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:812
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:945
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'messages' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/huggingface/langchain_huggingface/chat_models/huggingface.py:752
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/huggingface/langchain_huggingface/chat_models/huggingface.py:723
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1792
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:589
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:422
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:528
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

Network fetch combined with code execution/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/groq/langchain_groq/chat_models.py:1383
Scan critical

Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments

Network fetch combined with code execution/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/mistralai/langchain_mistralai/chat_models.py:86
Scan critical

Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/chat_models/base.py:701
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/chat_models/base.py:695
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'request' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1108
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:543
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:980
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Direct execution of LLM-generated code in 'create_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:543
Scan critical

Code Execution Security: 1. NEVER execute LLM-generated code directly with exec()/eval() 2. If code execution is necessary, use sandboxed environments (Docker, VM) 3. Implement strict code validation and static analysis before execution 4. Use allowlists for permitted functions/modules 5. Set resource limits (CPU, memory, time) for execution 6. Parse and validate code structure before running 7. Consider using safer alternatives (JSON, declarative configs) 8. Log all code execution attempts with full context 9. Require human review for generated code 10. Use tools like RestrictedPython for safer Python execution

User input 'request' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_emulator.py:134
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_emulator.py:150
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

User input 'request' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:288
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:295
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:297
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/summarization.py:562
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:245
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:244
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:281
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/contextual_compression.py:34
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/contextual_compression.py:27
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/merger_retriever.py:69
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/re_phraser.py:76
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/re_phraser.py:61
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/ensemble.py:224
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/ensemble.py:202
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:179
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'question' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:199
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:164
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:185
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/chat_memory.py:74
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore.py:73
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore.py:67
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chat_models/base.py:773
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chat_models/base.py:767
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:419
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:531
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'prompt_value' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:251
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:117
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:245
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/fix.py:81
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/example_generator.py:9
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:117
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input_list' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:241
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:112
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:120
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:224
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:413
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:413
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:369
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'question' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:67
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'question' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:137
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'text' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:81
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:96
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

LLM output used in dangerous command_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:81
Scan critical

Mitigations for Command Injection: 1. Never pass LLM output to shell commands 2. Use subprocess with shell=False and list arguments 3. Apply allowlist validation for expected values 4. Use shlex.quote() if shell execution is unavoidable 5. Consider alternative APIs that don't use shell

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:89
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/elasticsearch_database/base.py:116
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Network fetch combined with code execution/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/openai_functions/openapi.py:98
Scan critical

Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/sql_database/query.py:33
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:66
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_with_sources/retrieval.py:52
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_generation/base.py:121
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_generation/base.py:116
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/natbot/base.py:113
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'user_input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:147
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:135
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:198
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:250
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Direct execution of LLM-generated code in '_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:198
Scan critical

Code Execution Security: 1. NEVER execute LLM-generated code directly with exec()/eval() 2. If code execution is necessary, use sandboxed environments (Docker, VM) 3. Implement strict code validation and static analysis before execution 4. Use allowlists for permitted functions/modules 5. Set resource limits (CPU, memory, time) for execution 6. Parse and validate code structure before running 7. Consider using safer alternatives (JSON, declarative configs) 8. Log all code execution attempts with full context 9. Require human review for generated code 10. Use tools like RestrictedPython for safer Python execution High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Direct execution of LLM output in '_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:198
Scan critical

NEVER directly execute LLM-generated code: 1. Remove direct execution: - Do not use eval(), exec(), or os.system() - Avoid dynamic code execution - Use safer alternatives (allow-lists) 2. If code generation is required: - Generate code for review only - Require human approval before execution - Use sandboxing (containers, VMs) - Implement strict security policies 3. Use structured outputs: - Return data, not code - Use JSON schemas - Define clear interfaces 4. Add safeguards: - Static code analysis before execution - Whitelist allowed operations - Rate limiting and monitoring

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:125
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:96
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

LLM output used in dangerous sql_injection sink/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_multi_agent/base.py:228
Scan critical

Mitigations for SQL Injection: 1. Use parameterized queries: cursor.execute(query, (param,)) 2. Never concatenate LLM output into SQL 3. Use ORM query builders (SQLAlchemy, Django ORM) 4. Apply strict input validation 5. Use read-only database connections where possible

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_multi_agent/base.py:204
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/json_chat/base.py:14
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/react/agent.py:16
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:861
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/listwise_rerank.py:95
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/listwise_rerank.py:88
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/cross_encoder_rerank.py:31
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/chain_extract.py:68
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/self_query/base.py:316
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/self_query/base.py:310
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:402
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:492
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:389
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/chat_models.py:1113
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake.py:106
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake.py:98
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:378
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'inputs' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:431
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:518
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'prompts' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:788
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:368
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:508
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:781
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake_chat_models.py:158
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'query' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/retriever.py:65
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/retriever.py:62
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Network fetch combined with code execution/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/graph_mermaid.py:44
Scan critical

Secure Remote Code Patterns: 1. NEVER execute code fetched from network without verification 2. Use cryptographic signatures to verify downloaded code 3. Pin URLs and verify checksums 4. Use package managers instead of direct downloads 5. Sandbox execution in isolated environments

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:189
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:185
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:142
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:178
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:215
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:234
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:224
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:327
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:189
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:296
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/retry.py:188
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/retry.py:179
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:162
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:158
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:107
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:136
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:153
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:979
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

User input 'input_' embedded in LLM prompt/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:975
Scan critical

Mitigations: 1. Use structured prompt templates (e.g., LangChain PromptTemplate) 2. Implement input sanitization to remove prompt injection patterns 3. Use separate 'user' and 'system' message roles (ChatML format) 4. Apply input validation and length limits 5. Use allowlists for expected input formats 6. Consider prompt injection detection libraries

Model DoS vulnerability: No rate limiting, No input length validation, LLM calls in loops, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:1130
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:5685
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:901
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No input length validation, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:970
Scan critical

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1698
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1724
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk delete/write/network operation without confirmation in '_construct_responses_api_payload'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:3754
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write/execute/network operation without confirmation in '_generate'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1338
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Code execution on external content/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:147
Scan high

Secure Code Execution: 1. NEVER use eval/exec on untrusted input 2. Use safe alternatives (json.loads, ast.literal_eval) 3. Validate and sanitize all external content 4. Use sandboxed execution environments

High-risk write/execute/network operation without confirmation in '_convert_messages_to_ollama_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:812
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/llms.py:356
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/huggingface/langchain_huggingface/chat_models/huggingface.py:538
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:410
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1881
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1004
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1019
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk delete/execute/network operation without confirmation in '_format_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:410
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/qdrant/langchain_qdrant/fastembed_sparse.py:70
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/qdrant/langchain_qdrant/fastembed_sparse.py:79
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:415
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk write/execute operation without confirmation in '_stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:415
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write/execute operation without confirmation in '_generate'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/perplexity/langchain_perplexity/chat_models.py:589
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:395
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk write/execute/network operation without confirmation in 'bind_tools'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:395
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/prompty/langchain_prompty/core.py:191
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Hardcoded Generic API Key detected in assignment/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/mistralai/langchain_mistralai/chat_models.py:120
Scan high

Remove hardcoded secrets immediately: 1. Use environment variables: os.getenv('API_KEY') 2. Use secret management: AWS Secrets Manager, Azure Key Vault, HashiCorp Vault 3. Use configuration files (never commit to git): config.ini, .env 4. Rotate the exposed secret immediately 5. Scan git history for leaked secrets: git-secrets, truffleHog 6. Add secret scanning to CI/CD pipeline

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/embeddings/base.py:90
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/embeddings/base.py:144
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1100
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in '_execute_model_sync'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1100
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:218
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'wrap_model_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:218
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'count_tokens'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:244
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'count_tokens'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/context_editing.py:281
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in '_get_relevant_documents'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/contextual_compression.py:27
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/merger_retriever.py:53
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute operation without confirmation in 'merge_documents'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/merger_retriever.py:53
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in '_get_relevant_documents'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/re_phraser.py:61
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in 'rank_fusion'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/ensemble.py:202
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in '_get_relevant_documents'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:164
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'generate_queries'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/multi_query.py:185
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/embeddings/base.py:28
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/embeddings/base.py:83
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/chat_memory.py:98
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/summary_buffer.py:112
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute operation without confirmation in 'prune'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/summary_buffer.py:112
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore_token_buffer_memory.py:145
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'save_context'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/vectorstore_token_buffer_memory.py:145
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/entity.py:607
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/token_buffer.py:61
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'save_context'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/token_buffer.py:61
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'plan'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:419
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'plan'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:531
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:97
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/retry.py:234
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/fix.py:70
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'parse'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/output_parsers/fix.py:70
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/loading.py:115
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk write/execute/network operation without confirmation in 'load_evaluator'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/loading.py:115
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write/execute/network operation without confirmation in '_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:112
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write/execute/network operation without confirmation in 'apply'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:224
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in '__call__'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/base.py:369
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:34
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:104
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in '_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/hyde/base.py:89
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/openai_functions/citation_fuzzy_match.py:77
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:450
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:524
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/retrieval_qa/base.py:268
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute operation without confirmation in '_get_docs'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/retrieval_qa/base.py:268
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_with_sources/retrieval.py:46
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in '_get_docs'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_with_sources/retrieval.py:46
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write/execute/network operation without confirmation in '_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/qa_generation/base.py:116
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in '_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/natbot/base.py:113
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/conversational_retrieval/base.py:408
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in '_get_docs'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/conversational_retrieval/base.py:408
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Code execution on external content/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:237
Scan high

Secure Code Execution: 1. NEVER use eval/exec on untrusted input 2. Use safe alternatives (json.loads, ast.literal_eval) 3. Validate and sanitize all external content 4. Use sandboxed execution environments

High-risk execute/network operation without confirmation in '_do_generation'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:135
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/scoring/eval_chain.py:240
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/comparison/eval_chain.py:240
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/self_ask_with_search/base.py:97
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_tools/base.py:17
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, LLM calls in loops, No timeout configuration/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/agent_token_buffer_memory.py:75
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'save_context'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/agent_token_buffer_memory.py:75
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:287
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:18
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/xml/base.py:115
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:74
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:90
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:589
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in '_get_response'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_assistant/base.py:589
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:929
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:1512
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Insecure tool function '_run_llm' executes dangerous operations/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:861
Scan high

Secure Tool/Plugin Implementation: 1. NEVER execute shell commands from LLM output directly 2. Use allowlists for permitted commands/operations 3. Validate all file paths against allowed directories 4. Use parameterized queries - never raw SQL from LLM 5. Validate URLs against allowlist before HTTP requests 6. Implement strict input schemas (JSON Schema, Pydantic) 7. Add rate limiting and request throttling 8. Log all tool invocations for audit 9. Use principle of least privilege 10. Implement human-in-the-loop for destructive operations

High-risk execute/network operation without confirmation in '_run_chain'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:929
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/listwise_rerank.py:102
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute operation without confirmation in 'compress_documents'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/document_compressors/cross_encoder_rerank.py:31
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in '_get_relevant_documents'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/retrievers/self_query/base.py:310
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake.py:98
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/llms.py:415
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'batch'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/language_models/fake_chat_models.py:158
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:76
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:413
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:253
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:450
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:279
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk write/execute/network operation without confirmation in 'tool'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:76
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'convert_runnable_to_tool'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:413
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write/execute/network operation without confirmation in '_create_tool_factory'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:253
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in 'invoke_wrapper'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:450
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute operation without confirmation in 'invoke_wrapper'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/convert.py:279
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tools/retriever.py:31
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/pydantic.py:231
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/function_calling.py:193
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:156
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:142
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'batch'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:156
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/configurable.py:178
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:189
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/branch.py:296
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in '_invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/retry.py:179
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:107
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'batch'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:136
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/router.py:153
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/passthrough.py:480
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in '_invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/passthrough.py:480
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:867
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:937
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:4847
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk execute/network operation without confirmation in 'batch'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:867
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'batch_as_completed'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:937
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:1130
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in '_invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:4847
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:5685
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:901
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk execute/network operation without confirmation in 'invoke'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/runnables/base.py:970
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Model DoS vulnerability: No rate limiting, No timeout configuration, No token/context limits/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tracers/evaluation.py:64
Scan high

Model DoS Mitigations: 1. Implement rate limiting per user/IP (@limiter.limit('10/minute')) 2. Validate and limit input length (max 1000 chars) 3. Set token limits (max_tokens=500) 4. Configure timeouts (timeout=30 seconds) 5. Avoid LLM calls in unbounded loops 6. Implement circuit breakers for cascading failures 7. Monitor and alert on resource usage 8. Use queuing for batch processing 9. Implement cost controls and budgets

High-risk write/execute operation without confirmation in '__init__'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/tracers/evaluation.py:64
Scan high

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk network operation without confirmation in '_tokenize'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/embeddings/base.py:429
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk network operation without confirmation in 'get_num_tokens_from_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1724
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk network operation without confirmation in '_chat_params'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:720
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write operation without confirmation in '_create_chat_stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:945
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

LLM tool calling without permission checks in '_lc_tool_calls_to_anthropic_tool_use_blocks'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1885
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

LLM tool calling without permission checks in '_format_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:489
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

High-risk network operation without confirmation in 'convert_to_anthropic_tool'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1792
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk network operation without confirmation in '_lc_tool_calls_to_anthropic_tool_use_blocks'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:1881
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

LLM tool calling without permission checks in 'bind_tools'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:422
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

High-risk network operation without confirmation in 'save_context'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/chat_memory.py:74
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Dynamic tool/plugin loading/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/__init__.py:56
Scan medium

Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution

Dynamic tool/plugin loading/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/__init__.py:154
Scan medium

Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution

Unpinned model version in API call/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/evaluation/loading.py:168
Scan medium

Supply Chain Security Best Practices: 1. Pin model versions explicitly (model='gpt-4-0613') 2. Use model registries with version control 3. Document model versions in requirements.txt or similar 4. Implement model versioning in CI/CD pipelines

LLM tool calling without permission checks in 'create_openai_tools_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_tools/base.py:100
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

LLM tool calling without permission checks in 'create_openai_functions_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:372
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

LLM tool calling without permission checks in 'plan'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:125
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

LLM tool calling without permission checks in 'plan'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_multi_agent/base.py:228
Scan medium

Tool Calling Security Best Practices: 1. Implement permission checks before tool execution (check_permission, authorize) 2. Use allowlists to restrict which tools can be called 3. Require human confirmation for sensitive operations 4. Log all tool executions with context for audit trails 5. Implement rate limiting on tool calls to prevent abuse 6. Use least-privilege principle - only grant necessary permissions 7. Add input validation for tool parameters 8. Consider implementing a "dry-run" mode for testing 9. Set up alerts for unusual tool usage patterns 10. Document tool permissions and restrictions clearly

Dynamic tool/plugin loading/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:18
Scan medium

Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution

Dynamic tool/plugin loading/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:44
Scan medium

Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution

Dynamic tool/plugin loading/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:67
Scan medium

Secure Tool Loading: 1. Validate tool names against an allowlist 2. Only load tools from trusted sources 3. Review tool permissions before loading 4. Sandbox tool execution

High-risk write operation without confirmation in '_create_subset_model_v2'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/pydantic.py:231
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

High-risk write operation without confirmation in '_convert_python_function_to_openai_function'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/function_calling.py:193
Scan medium

High-Risk Operation Safety: 1. Require explicit user confirmation for destructive actions 2. Display clear preview of what will be changed/deleted 3. Implement "undo" functionality where possible 4. Use transaction rollback for database operations 5. Add time delays before executing irreversible actions 6. Send notifications for critical operations 7. Implement approval workflows for sensitive operations 8. Maintain detailed audit logs of all actions 9. Use "dry-run" mode to show what would happen 10. Consider implementing operation quotas/limits

Code execution on external content/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/documents/base.py:7
Scan medium

Secure Code Execution: 1. NEVER use eval/exec on untrusted input 2. Use safe alternatives (json.loads, ast.literal_eval) 3. Validate and sanitize all external content 4. Use sandboxed execution environments

Critical decision without oversight in '_construct_responses_api_payload'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:3754
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in 'get_num_tokens_from_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/openai/langchain_openai/chat_models/base.py:1724
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in '_convert_messages_to_ollama_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:812
Scan low

Critical security, data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Automated action without confidence threshold in '_create_chat_stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/chat_models.py:945
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Automated action without confidence threshold in '_create_generate_stream'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/ollama/langchain_ollama/llms.py:356
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in '_format_messages'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/anthropic/langchain_anthropic/chat_models.py:410
Scan low

Critical security, data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in 'bind_tools'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/partners/deepseek/langchain_deepseek/chat_models.py:395
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Automated action without confidence threshold in '_execute_model_sync'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/factory.py:1100
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'wrap_model_call'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/tool_selection.py:270
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Automated action without confidence threshold in '_create_summary'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain_v1/langchain/agents/middleware/summarization.py:562
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Automated action without confidence threshold in 'prune'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/memory/summary_buffer.py:112
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'plan'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:419
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in 'plan'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/agent.py:531
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Automated action without confidence threshold in 'apply'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/llm.py:224
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'query'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:34
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in 'query_with_sources'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/indexes/vectorstore.py:104
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Automated action without confidence threshold in 'create_citation_fuzzy_match_runnable'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/openai_functions/citation_fuzzy_match.py:77
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'create_sql_query_chain'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/sql_database/query.py:33
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Automated action without confidence threshold in '_create_openai_tools_runnable'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/structured_output/base.py:450
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'from_llm'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/chains/flare/base.py:250
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Automated action without confidence threshold in 'create_self_ask_with_search_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/self_ask_with_search/base.py:97
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'create_openai_tools_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_tools/base.py:17
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'create_openai_functions_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/openai_functions_agent/base.py:287
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'create_tool_calling_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/tool_calling_agent/base.py:18
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'create_structured_chat_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/structured_chat/base.py:166
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in 'create_json_chat_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/json_chat/base.py:14
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards

Critical decision without oversight in 'create_xml_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/xml/base.py:115
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'create_react_agent'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/agents/react/agent.py:16
Scan low

Critical security decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in '_run_llm'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:861
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in 'run_on_dataset'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:1512
Scan low

Critical security, data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Automated action without confidence threshold in '_run_chain'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/langchain/langchain_classic/smith/evaluation/runner_utils.py:929
Scan low

Implement confidence thresholds for automated actions: 1. Add confidence scoring: - Request confidence scores from LLM - Calculate custom confidence metrics - Track historical accuracy 2. Set thresholds: - High confidence (>0.9): Auto-execute - Medium confidence (0.7-0.9): Human review - Low confidence (<0.7): Reject or escalate 3. Validate output: - Use schema validation (Pydantic) - Check output format and constraints - Verify against expected patterns 4. Implement fallbacks: - Have backup strategies for low confidence - Use simpler/safer alternatives - Escalate to human operators

Critical decision without oversight in '_convert_pydantic_to_openai_function'/var/folders/xr/487hfwq1609_955mpzlxvkb80000gn/T/aisentry-scan-alrxscxf/libs/core/langchain_core/utils/function_calling.py:153
Scan low

Critical data_modification decision requires human oversight: 1. Implement human-in-the-loop review: - Add review queue for high-stakes decisions - Require explicit human approval before execution - Log all decisions for audit trail 2. Add verification mechanisms: - Cross-reference with trusted sources - Implement multi-step verification - Use confidence thresholds 3. Include safety checks: - Set limits on transaction amounts - Require secondary confirmation - Implement rollback mechanisms 4. Add disclaimers: - Inform users output may be incorrect - Recommend professional consultation - Document limitations clearly 5. Monitor and review: - Track decision outcomes - Review failures and near-misses - Continuously improve safeguards