How to Security-Test a LangChain Agent Using a 15-Line FastAPI Wrapper

·1 views

Developers often ship AI agents to production after a successful demo without conducting adversarial security testing, leaving a critical gap between functional validation and real-world safety. Functional tests only verify expected inputs and miss scenarios like prompt injection, scope violations, tool misuse, and goal hijacking — threats categorized in the OWASP Top 10 for Agentic Applications. The article demonstrates how a tool called Humanbound red-teams a live agent using OWASP-aligned attack scenarios, grading transcripts into a security posture score. Because Humanbound operates as a black-box HTTP tester, agents built with frameworks like LangChain must first be wrapped in a lightweight HTTP service, such as a FastAPI endpoint, to be compatible. The post walks through a sample LangChain support agent with order lookup and refund tools, then shows how a minimal server wrapper bridges the gap between a local .invoke() agent and the security testing interface.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Baidu's LoongForge Framework Cuts Embodied AI Model Training Time in Half

Baidu has released LoongForge, an open-source framework designed to accelerate the training of embodied AI models, available on GitHub. The framework supports a range of mainstream embodied AI models including pi05, GR00T, xVLA, FastWAM, and DreamZero, among others. It is designed to work out of the box and claims to deliver roughly 200% acceleration, effectively halving training time without altering model outputs. The release aims to address growing challenges in AI development such as expanding task lists, longer experiment queues, and rising compute costs. Baidu is inviting the open-source community to contribute, raise issues, and collaborate on further development of the project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FUI-RS lets Rust apps run natively on desktop and browser without Electron

FUI-RS is an early-access, cross-platform UI framework written in Rust that targets both native desktop and web browsers under a single application model. The framework includes core UI components such as controls, layouts, themes, event handling, dialogs, and custom drawing, all built on a shared architecture to avoid separate codebases. Because it is pre-1.0, its APIs remain subject to change, but the project is open to community contributions and issue reports. A community-developed Galaga-style space shooter already runs on FUI-RS, serving as a practical stress test for the young framework. The project is publicly available on GitHub for Rust developers interested in exploring cross-platform UI development outside the Electron ecosystem.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HMAC-Signed Cookies Offer a Faster, Cache-Friendly Alternative to PHP Sessions

A developer on DEV Community has detailed a method to replace PHP's session_start() in paywall implementations using HMAC-signed cookies and single-use recovery links. The traditional session-based approach causes two key problems: access is lost when the browser closes, and session headers prevent CDNs and page caches from caching responses for any visitor. The proposed solution uses a 90-day HMAC-signed cookie that encodes a user's email and expiry timestamp, verified server-side without storing any session state. A separate single-use recovery link, valid for 24 hours, allows purchasers to restore access on a new device. The design, drawn from a WordPress plugin, is framework-independent and incorporates security measures such as timing-safe hash comparison and structurally enforced payload parsing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source JS/TS Library Offers Transliteration Across 50 Languages and 2,450 Pairs

A developer has released a JavaScript and TypeScript library designed to handle transliteration between 50 of the world's most popular languages, covering 2,450 directional language combinations. Unlike most existing tools, which only convert non-Latin scripts into Latin characters (romanization), this library also supports transliteration from Latin-based languages into scripts such as Arabic, Chinese, Hindi, and Greek. The library aims to produce accurate, human-readable results by applying language-specific orthographic rules rather than simple letter-by-letter substitution. It is self-hosted and free to use, addressing limitations found in alternatives like Google Translate API and AI tools, which can mistranslate, hallucinate, or incur costs. The project's stated goal is to enable speakers of a target language to correctly pronounce words originating from a source language.

0 comments Read more at DEV Community