Type: url
Original: https://developer.nvidia.com/blog/securing-llm-systems-against-prompt-injection/
Status: generated
Summary
The NVIDIA AI Red Team discloses three vulnerabilities in LangChain chains — remote code execution in llm_math (CVE-2023-29374), server-side request forgery in APIChain.from_llm_and_api_docs (CVE-2023-32786) and SQL injection in SQLDatabaseChain (CVE-2023-32785) — all reachable by prompt-injecting the model whose output the chain then turns into a call to an external service. The post is explicit that these affect specific chains rather than LangChain’s core engine, and that the affected components had been removed from the core library by the time of writing. Its general argument is that control and data planes are not separable in an LLM prompt, so every model production should be treated as potentially malicious and external calls strictly parameterized at least privilege.