Add LangGraph ASI02 tool-misuse (confused deputy) code sample - #18
Open
AUSTIN-OMONDI wants to merge 1 commit into
Open
Add LangGraph ASI02 tool-misuse (confused deputy) code sample#18AUSTIN-OMONDI wants to merge 1 commit into
AUSTIN-OMONDI wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the first LangGraph example under code_samples/agentic_top_ten/frameworks/,
and the first code sample for ASI02 – Tool Misuse and Exploitation.
Why
The agentic_top_ten code-sample set currently covers only mastra and pydantic
(goal-manipulation invoice agents). There is no LangGraph example and no ASI02
example. LangGraph is one of the frameworks listed as covered in the repo README,
so this closes that gap for the agentic Top 10 set.
The sample
A three-node pipeline (Planner → Researcher → Executor) sharing one AgentState
with no trust boundary. Untrusted content fetched by the Researcher flows verbatim
into the Executor's instruction channel — a confused-deputy chain that ends in
tool-argument injection through an unguarded shell tool. Payload is delivered via
indirect prompt injection (hidden HTML comment / white-on-white text) in
poisoned_page.html.
Runs both benign (
python agent.py) and attack (python agent.py --attack) modes;success signal is a harmless, greppable marker in the execution log. Includes a
README (functionality, vulnerability writeup, OWASP ASI02 + LLM Top 10 crosswalk,
prerequisites, mitigations) and a Dockerfile per CONTRIBUTING.
Safety
Intentionally insecure, educational only; all destructive potential is replaced by
a harmless marker command. No credentials, no network side effects, no real data.