AI agent secret compromise possible with critical langchain-core vulnerability

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical LangChain Vulnerability Enables Secret Exfiltration A critical vulnerability in LangChain’s core library (CVE-2025-68664) was discovered, allowing attackers to exfiltrate sensitive environment variables and potentially execute code through deserialization flaws. The issue, affecting a widely used AI framework with hundreds of millions of downloads, was patched just before Christmas 2025. 6 sources 45