LangSmith Bug Exposes Dangerous Gaps in AI Security: What It Means for Your Business

Why This Security Flaw Is Bigger Than Just LangSmith Users

Last week, researchers uncovered a critical vulnerability—dubbed AgentSmith—in LangChain’s LangSmith platform. This now-patched bug could have let hackers steal sensitive data, including OpenAI API keys and user prompts, if they tricked end-users into deploying malicious agents. While LangSmith may sound niche, the underlying risk is universal: most small and midsize businesses (SMBs) are layering new AI tools into operations faster than their defenses can keep up.

Why does this matter if you’re not a LangSmith customer? Because the same security blind spots—overly trusted plugins, insufficient API protections, and lack of supply chain oversight—exist in countless business applications connected to productivity suites, CRMs, and AI-powered tools. If you’re using or testing AI assistants, bots, or SaaS plugins, you could be vulnerable to similar tactics.

What Happened—and Why It’s a Wakeup Call

According to Noma Security, the LangSmith flaw scored 8.8 out of 10 on the CVSS risk scale. In plain English: attack techniques here can be replicated in any environment where employees use AI agents that connect to services with sensitive access like email or internal databases. Attackers could plant malicious agents to siphon off API keys and prompts—letting them hijack business data or even inject false outputs into your AI workflows.

Note: 83% of organizations have experienced at least one data breach involving third-party software in the past 2 years (IBM Cost of a Data Breach Report, 2023).

New technology means new attack surfaces. Bolting on AI can streamline work, but it also introduces hidden dependencies and accountability gaps. Most SMBs lack the internal resources to vet or monitor every cloud tool, plugin, or AI integration for supply chain risk. That’s why it’s crucial to get ahead of these risks before attackers do.

Key Takeaways: Secure, Simplify, and Cut Unplanned Costs Now

Audit your AI and SaaS connections. Inventory all tools and plugins with access to sensitive company or customer data. Review permission scopes and remove unused or overly-permissive connections.
Enforce least-privilege access. Don’t allow plugins or agents to access more data than strictly required, especially API keys or core business data.
Deploy device threat protection and identity security. Modern endpoint and identity threat solutions catch suspicious plugin behaviors and block rogue agent activity—even from “trusted” platforms. (See BoltWork’s Device Threat Protection and Identity Threat Protection offerings.)
Require security checks for new tools. Before adding any AI or SaaS plugin, verify its security posture and demand vendor transparency on how access is granted, logged, and revoked in case of compromise.
Train staff on software supply chain risk. Regularly update employees on the dangers of authorizing new plugins or agents—especially those asking for broad access or promising shortcuts.

Want a tailored review of your cloud and AI integrations? Book a 15-minute security consult with BoltWork.ai now and get practical steps to close gaps fast.

Prevent a Supply-Chain Attack Before It Drains Your Resources

Attackers are constantly looking for weak points in the software supply chain—and with the explosion of connected SaaS and AI agents, the cost of a misstep is rising fast. According to IBM’s latest report, the average SMB breach now costs over $2.5 million, with third-party attacks driving damages higher (IBM, 2023). Investing in continuous monitoring, zero-trust access, and managed IT support is not just about compliance—it’s about business continuity and peace of mind.

BoltWork.ai delivers affordable, predictable security for businesses up to 100 seats—covering AI, SaaS, devices, and user identities—so you can focus on growth instead of patching holes.

Ready to Secure and Simplify Your Stack?

The LangSmith incident is a reminder: if you’re not proactively managing how AI and SaaS tools connect to your data, you’re leaving the door open to costly attacks and reputational harm.
Book your free 15-minute BoltWork.ai security consult today and protect your business the smart way.

References

IBM Cost of a Data Breach Report, 2023
Noma Security disclosure, The Hacker News, June 2025