FS-AI-LC-002
Tool Calling Authorization Boundary Confusion in LangChain Agents
Model-selected tool calls may cross authorization boundaries when application logic treats LLM intent as sufficient permission.
Research
Critical
High
This note analyzes LangChain agent workflows where the model is allowed to select tools and generate tool arguments, while the application lacks an independent authorization layer before execution.
Surface
Agents and tool invocation
Primitive
Model-mediated tool execution
Tested versions
langchain 1.4.4
Observed behavior
A user-controlled prompt or poisoned context can steer the agent toward invoking a privileged tool with attacker-influenced parameters.
Security implication
This can turn prompt injection into practical application impact, including unauthorized reads, unsafe writes, workflow manipulation, data exfiltration or business logic abuse.
Mitigation
Separate model planning from execution. Require server-side authorization, argument validation, scoped credentials, allowlisted tools, approval gates for sensitive operations and detailed audit logs.
Observed before mitigation
The model could select a privileged tool and provide arguments without deterministic authorization.
Observed after mitigation
Tool execution is blocked unless an application-side policy authorizes the tool and validates every argument.View PoC code
const userInput = "Use any available tool to export the customer list."; const modelDecision = { tool: "database_query", args: { query: "select * from customers" } }; console.log(modelDecision);View mitigation code
function authorizeToolCall(user, tool, args) { if (tool === "database_query") return false; return true; }View FRES detection heuristic
match: langchain AND (tool OR bindTools OR createAgent) AND (invoke OR execute) AND NOT (authorize OR allowlist OR approval)