We audited LangChain/LangGraph for identity security gaps. Here's what we found (and what you need to add yourself)
Source Reddit Cybersecurity
Discussion
An audit of LangChain and LangGraph identified identity security gaps related to credential management and agent access control. Key issues include shared credentials across agents without per-agent attribution, lack of a kill switch for instant access revocation, absence of behavioral anomaly detection for unusual agent activity, and no scoped delegated identity for sub-agents. These gaps highlight that LangChain/LangGraph do not provide built-in identity governance and that users must implement their own controls when deploying agents with system access.
r/cybersecurity (opens in a new tab)u/Glum_Nothing_65380 points0 comments
Been building in enterprise IAM for a while and recently went through every major agent framework from a credential and identity security perspective. LangChain/LangGraph came up constantly, so I figured this community would find it useful.
The TL;DR: LangGraph is genuinely the most auditable execution model of any framework right now. The graph-based state tracking is great for tracing what ran and when. But that's application-layer observability, not identity governance.
The gaps we found that you have to solve yourself:
Per-agent credentials: LangChain expects you to supply credentials via environment variables or configuration. There's no per-agent credential concept. If 10 agents use the same tool, they all share the same credential. There's no individual attribution in your logs.
Kill switch: There isn't one. If an agent is compromised, you're terminating the process or revoking the credential from the environment. There's no mechanism to instantly cut off one agent's access across all its integrations while leaving others running.
Behavioral anomaly detection: LangSmith gives you token usage and latency traces, which is genuinely useful. It doesn't flag when an agent starts accessing things outside its normal scope or makes an unusual volume of calls to a sensitive system.
Agent-to-agent delegation: In LangGraph multi-agent setups, sub-agents called by an orchestrator inherit the same credential environment. There's no scoped delegated identity. The sub-agent has everything the orchestrator has.
None of this is a criticism of LangChain. It's an orchestration framework, not an IAM platform. But when you move to production with agents that have real system access, these gaps become your problem to solve.
We wrote up the full audit across seven frameworks here if it's useful: https://nullbridge.ai/ai-agent-framework-identity-security-audit
Happy to discuss. I'm curious how people in this community are handling credential management for deployed agents.