LangChain Penetration Testing
A LangChain agent chooses its own tool and arguments, from a database query to a shell command. We test what each tool can actually reach, not what the prompt assumes. CREST-certified testers, fixed price from £6,000 for a 5-day single-application scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
An agent’s tools decide what it can actually do to your systems, not the instructions telling it to behave. We test whether each tool’s permissions match the task, not the trust placed in the model.
Why LangChain security comes down to what each tool is allowed to do
LangChain’s tool-calling design leaves the model to decide which tool to call and what arguments to pass it, so a database query tool, a shell tool or a Python execution tool is only as safe as the credential or interpreter sitting behind it. OWASP’s Excessive Agency guidance is specific about what that should look like: a database tool should hold read-only permissions where that is all the task needs, and an open-ended shell tool should be replaced with a narrower, purpose-built one. We test what each tool in your agent can actually reach, not what its description says it does.
Retrieval in LangChain works by handing a query to a retriever and getting back whichever documents rank closest in the vector store, with no user or tenant check built into that call by default. Memory works the same way: short-term memory is scoped to a thread by a checkpointer and thread ID, and long-term memory is scoped to whichever namespace a developer chose, usually a user or organisation ID. We test whether a query, a thread ID or a namespace can be made to cross into another account’s documents or memory.
LangGraph’s interrupt function can pause a graph before a sensitive tool call and hand the decision to a human, and LangChain’s human-in-the-loop middleware builds approve, edit and reject decisions on top of it, but only for the tool calls a developer actually configured that way. Everything else runs automatically. The same visibility that makes an agent debuggable, LangSmith tracing a run’s inputs, outputs and tool calls by default, is also a record of whatever secrets or customer data passed through it, so we check what a trace holds against what was meant to leave the application. It is the same permissions question we test on our wider AI and LLM penetration testing engagements, applied to LangChain’s own tools, memory and tracing.
SCOPE
What we pen test on a LangChain application
Tool Permission Boundaries
LangChain’s create_agent lets the model choose which tool to call and what arguments to pass it, so a tool’s own permissions are the only limit on what the agent can do. We test whether each tool follows OWASP’s excessive-agency guidance to grant no more than the minimum functionality and permissions the task needs.
SQL, Shell and Code-Execution Tools
A database, shell or Python tool wired into an agent inherits whatever access its underlying credential or interpreter has, regardless of what the tool’s description implies. We test whether a query tool is restricted to read-only access and whether a shell or code tool is scoped to a specific function rather than left open-ended.
Retrieval Access and Tenant Filtering
LangChain’s retriever interface returns documents for a query without enforcing who is allowed to see them, so scoping by user or tenant has to be built into the retrieval call itself. We test whether a query from one account can return chunks that belong to another.
Session and Memory Separation Between Users
Short-term memory is scoped to a thread by its checkpointer and thread ID, and long-term memory is scoped by the namespace a developer chooses, usually a user or organisation ID. We test whether a thread ID or namespace can be guessed, reused or crossed into another user’s memory.
Prompt Injection Into Tool Calls
OWASP’s LLM Top 10 treats direct and indirect prompt injection as the route by which malicious instructions in a user message or a retrieved document reach an agent’s tool-calling decision. We test both paths, including injected content sitting inside a document your retrieval tool returns.
Output Handling Into Code, SQL and HTML
An agent’s output is model-generated text before it becomes a database query, a shell argument or HTML on a page, and OWASP’s improper output handling category covers exactly that gap. We test what happens when a tool’s return value or the model’s final answer reaches a downstream interpreter unescaped.
LangGraph Human-in-the-Loop Approval
LangGraph’s interrupt function can pause a graph before a tool call executes and hand the decision to a human to approve, edit or reject it, but only for the tool calls a developer actually configured that way. We test which actions are gated behind approval and which run automatically.
Secrets in Chains and Configuration
Model provider keys, database credentials and third-party API tokens usually reach a chain through environment variables or a config object, and either path can end with a secret hardcoded, logged or committed by mistake. We test where each credential lives and what an attacker who reaches the application gains access to.
LangSmith Tracing and Sensitive Data
LangSmith captures a run’s inputs, outputs and tool calls by default, so a trace can hold customer data or credentials unless a project is configured to hide or mask them. We check trace visibility, retention and masking settings against what should actually leave your systems.
Python Surface Beyond the Agent
A LangChain agent runs inside a wider Python application, and code outside the agent loop, such as the web server, request handlers or background jobs, sits outside LangChain’s own scope entirely. If that surface goes beyond the LangChain integration itself, our wider Python penetration testing covers it too.
OUR PROCESS
LangChain Applications Penetration Testing: From Scope to Attestation
Scope and Access
We agree which environment, model provider and tool set are in scope, plus credentials for every user role and any accounts your agent’s tools rely on, including database or shell access.
Tool and Retrieval Mapping
We map every tool an agent can call against what its underlying credential actually permits, and check whether retrieval calls, thread IDs and memory namespaces are scoped by user or tenant.
Manual Testing
A CREST-certified tester manually attempts prompt injection, tool misuse and output-handling failures, chaining findings where a single weak boundary lets one issue reach another.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST LangChain pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent LangChain Applications Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
Depends on AI system complexity
Single LLM-powered chatbot, basic RAG (≤100 documents), no agent tools. Around 5 to 7 working days from kickoff to report.
Get a fixed quoteDepends on AI system complexity
Multi-tool agent system, complex RAG pipeline, fine-tuned model, multi-tenant. Around 8 to 12 working days from kickoff to report.
Get a fixed quoteDepends on AI system complexity
Production AI platform, multi-agent orchestration, regulated AI use case (FCA, NHS), custom-trained models. Around 12 to 18 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test LangChain For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From LangChain Applications Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our LangChain application?
We need working credentials for at least one account per role your application exposes, plus visibility into the tools your agent can call, including which ones hold destructive access such as a write-capable database connection or a shell tool. If you use LangGraph’s human-in-the-loop middleware, we also need to know which tool calls are gated behind approval and which run automatically.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as destructive tool calls, real payment actions or outbound emails, and we do not run untested prompts against real customer records or a production vector store without that agreement in writing.
How long does a LangChain application penetration test take?
A single LangChain application sits in our 5-day single-application scope, with a report typically landing around 5 to 7 working days after kickoff. An application with a multi-tool agent, multiple tenants or a fine-tuned model moves into a wider AI penetration testing scope with more testing days.
Do you test LangChain running on our own infrastructure as well as hosted deployments?
Yes. We test LangChain agents you run yourself, in your own containers or servers, the same way as a LangChain application deployed on a managed platform. The tool, retrieval and memory testing is the same either way; only the infrastructure-level checks around the hosting platform change, and those are scoped as cloud penetration testing where needed.
What is out of scope for a single-application LangChain test?
The underlying model provider’s own infrastructure, whether that is OpenAI, Anthropic, Google or a self-hosted model, is out of scope; we test how your application uses the model, not the model provider’s platform. A separate agent, tool server or MCP server that sits outside this application’s LangChain integration is scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the tool definitions, the interrupt_on configuration for LangGraph’s human-in-the-loop middleware, and how retrieval calls are scoped, is available if you want faster or deeper coverage of specific findings.
Does LangChain have a customer penetration-testing policy we need to follow?
LangChain is an open-source library you deploy and control yourself, so there is no vendor notification process for the library itself. If your application uses LangSmith for tracing, or a hosted model provider, we confirm that vendor’s current penetration-testing and acceptable-use terms during scoping before any testing begins.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your LangChain application
A LangChain agent chooses its own tool and arguments, from a database query to a shell command. We test what each tool can actually reach, not what the prompt assumes. CREST-certified testers, fixed price from £6,000 for a 5-day single-application scope, quoted within 24 hours.
