Enterprise Account Executive

LangSmith gets full OTel support: what it means. LangSmith now ships full OpenTelemetry support in its SDK. Here's what changed, what it costs you, and when you should actually use it. The observability problem nobody talks about honestly. Building an LLM application is one thing. Knowing what it's actually doing at 2 AM when something goes sideways is another problem entirely. Traditional observability tools were built for a world where 'something broke' meant an exception was thrown or a response time spiked past a threshold. They're good at that. But an LLM application can fail in ways that never trigger an alert - the model drifts toward a weird tone, a multi-step agent loop quietly skips a tool call, or a retrieval step returns documents that are technically relevant but practically useless. No exception. No timeout. Just a subtly wrong answer that your users notice before your monitoring does. This is why the question of how you collect and route telemetry data from LLM applications matters so much more than it did for traditional services. And it's why LangSmith's move to ship full end-to-end OpenTelemetry support in its SDK is worth paying attention to - not because it's flashy, but because it quietly solves a real infrastructure headache for teams running complex, multi-service AI systems. What actually changed. Here's the thing about this update that the announcement buries a little: LangSmith already accepted OpenTelemetry traces. It could ingest them on the backend. What it couldn't do was emit them natively from the SDK itself. That meant the OTel pipeline was half-built. You could receive OTel data, but generating it from your LangChain or LangGraph code required extra wiring that most teams didn't bother with. Now the SDK handles the whole pipeline. Your LangChain application generates traces, the LangSmith SDK converts and ships them in the OTel standard format, and those traces land wherever you've pointed your collector - LangSmith's own dashboard, Datadog, Grafana, Jaeger, or all of the above simultaneously. That last part is the real unlock for teams that already have an observability stack and don't want to maintain a separate silo just for their AI layer. Getting started is deliberately minimal. Install the package with OTel support: pip install 'langsmith[otel]' pip install langchain Then set three environment variables: LANGSMITH_OTEL_ENABLED=true LANGSMITH_TRACING=true LANGSMITH_API_KEY=your_key_here That's it. Your existing LangChain code doesn't need to change. The instrumentation happens automatically. For teams that have been avoiding observability setup because it felt like a project unto itself, this is a meaningful reduction in friction. Why OTel is a good fit for LLM tracing (and where it gets complicated). OpenTelemetry's core value proposition is vendor neutrality. It's an open standard, which means the data format isn't owned by any single observability vendor. You instrument once and you can route that telemetry anywhere. For conventional microservices, this has been a genuine quality-of-life improvement - teams stopped being locked into whichever APM tool they chose three years ago. For LLM applications, the fit is mostly good but not perfect. OTel was designed around the concept of spans - discrete units of work with a start time, end time, and a set of attributes. That maps reasonably well onto a chain execution: each LLM call, each tool invocation, each retrieval step can be its own span. Distributed tracing across microservices works exactly as you'd expect, with context propagation linking spans from different services into a single coherent trace. The complications show up at the edges. LLM outputs are stochastic - the same prompt doesn't always produce the same response, and 'correctness' isn't a binary you can encode in a span attribute. The emerging OpenTelemetry GenAI semantic conventions are trying to standardize how things like model name, token counts, and prompt/response content get attached to spans, but those conventions are still evolving. It's worth asking, before you commit to any OTel-based setup, whether the platform you're sending traces to actually understands those conventions or just treats your LLM spans as generic HTTP calls with extra attributes. LangSmith's own dashboard is built specifically for LLM traces, so it handles the nuances - token usage, evaluation scores, intermediate reasoning steps - in ways that a general-purpose tool like Grafana won't do out of the box. That's not a knock on Grafana; it's just a different tool for a different job. The performance trade-off is real, and you should care. LangSmith is upfront about this: the OTel format carries more overhead than their native tracing format. The native format was designed specifically for LLM data patterns - it's leaner, it supports real-time tracing with pending run states (so you can watch a long agent loop execute step by step), and it has a smaller memory footprint in the SDK. The OTel format is more general-purpose. That generality costs something. How much it costs depends on your workload, but if you're running a high-throughput production system where every millisecond of added latency compounds, you'll want to benchmark both formats under realistic load before committing. The practical guidance is straightforward: if LangSmith is your only observability destination and you have no plans to route traces anywhere else, stick with native tracing. You get better performance and features like pending run visibility that OTel doesn't support. If you need traces in Datadog for your SRE team and in LangSmith for your ML team, the OTel integration is the right call - just accept that you're paying a small performance tax for the flexibility. The questions this update doesn't answer. A few things worth thinking through before you wire this into production. First, trace volume. An agent that makes twenty tool calls per user request generates a lot of spans. At any meaningful scale, that's a storage and cost problem. OTel has sampling strategies - head-based, tail-based - that let you capture a representative subset of traces rather than every single one. The LangSmith integration doesn't spell out how sampling is configured or what the defaults are. For a small application this doesn't matter. For a system handling thousands of requests per hour, you'll want to understand this before your observability bill becomes uncomfortable. Second, data privacy. Traces from LLM applications often contain the actual prompts and responses - which means they can contain sensitive user data. Shipping those traces through an OTel pipeline to multiple destinations means that data flows through more systems. Whether LangSmith offers any built-in masking or redaction for sensitive fields in the OTel path isn't clear from the current documentation. If your application handles anything regulated - healthcare, finance, legal - this is a conversation to have before enabling the integration. Third, framework scope. The integration is explicitly for LangChain and LangGraph. Teams using LlamaIndex, or calling the OpenAI SDK directly, or building on other frameworks aren't covered here. OTel instrumentation libraries exist for many of these, but the seamless LangSmith integration described in this release is LangChain-specific. Worth knowing if your stack is mixed. The bigger picture. There's a broader pattern worth naming. The AI tooling ecosystem is maturing, and part of that maturation is AI-specific tools starting to speak the same language as the broader infrastructure world. For a long time, LLM observability was a separate island - you had your model metrics over here and your infrastructure metrics over there, and getting a unified view required custom glue code or a lot of tab-switching. OTel support in LangSmith is a step toward making the AI layer a first-class citizen in existing observability stacks. Your SRE team can use the tools they already know. Your AI team gets the LLM-specific visibility they need. The two don't have to be completely separate concerns anymore. That's genuinely useful progress. Not because it's technically unprecedented - OTel instrumentation has existed for plenty of frameworks - but because it removes the excuse for AI teams to skip proper observability setup. 'It's too much work to integrate with its existing stack' gets harder to argue when the integration is three environment variables and a pip install. The teams that will benefit most are the ones already running mature observability infrastructure who've been treating their LLM layer as a black box because wiring it up felt like a separate project. For them, this is the bridge they've been waiting for. #Platform / Product Updates #GZOO #BusinessAutomation

LangChain and LangGraph CVEs: what your deployment needs to know. LangChain and LangGraph carried three disclosed CVEs as of March 2026 - a path-traversal flaw, a critical deserialization bug, and a SQL injection in LangGraph's checkpoint store - that together let an attacker read arbitrary files, exfiltrate environment secrets, and manipulate conversation-history queries. If your deployment predates the March 2026 patch cycle, this is the first thing to check before anything else in this post. What happened. Security researcher Vladimir Tokarev at Cyera disclosed three separate vulnerabilities across the LangChain ecosystem on 27 March 2026, characterizing them as "three independent paths" to drain sensitive data - filesystem contents, environment secrets, and conversation histories - from any enterprise LangChain deployment (The Hacker News, 27 Mar 2026). One of the three, "LangGrinch," had actually first been flagged by Cyata in December 2025 before being formally CVE-assigned and re-covered in the March wave. The scale matters as much as the severity. LangChain, LangChain-Core, and LangGraph together see 52M+, 23M+, and 9M+ weekly downloads respectively (The Hacker News, 27 Mar 2026). A vulnerability class that ships to that many installs by default is a supply-chain event for the agent ecosystem, not an isolated bug report - the same reasoning that applies to any widely-vendored open-source dependency now applies squarely to agent orchestration frameworks. As of late August 2026, this remains the reference framework-security incident for LangChain and LangGraph, five months on from disclosure. The three CVEs. Each of the three targets a different layer of a typical LangChain/LangGraph deployment: prompt loading, object deserialization, and checkpoint persistence. | CVE | Component | CVSS | What it allows | | CVE-2026-34070 | LangChain prompt-loading API | 7.5 | Path traversal - access to arbitrary files without validation via a crafted prompt template | | CVE-2025-68664 ("LangGrinch") | LangChain deserialization | 9.3 | Leaks API keys and environment secrets through unsafe deserialization | | CVE-2025-67644 | LangGraph SQLite checkpoint implementation | 7.3 | SQL injection via metadata filter keys, manipulating checkpoint queries | CVE-2026-34070 sits in LangChain's prompt-loading API. A crafted prompt template can traverse outside the intended directory and pull arbitrary files off the host - no input validation stands between the template path and the filesystem read (The Hacker News, 27 Mar 2026). CVE-2025-68664, the highest-severity of the three at CVSS 9.3, is a deserialization vulnerability that leaks API keys and environment secrets. It was the first of the three publicly flagged, by Cyata in December 2025, months before it carried a formal CVE identifier - a reminder that community disclosure and formal CVE assignment can run on very different timelines (The Hacker News, 27 Mar 2026). CVE-2025-67644 is the LangGraph-specific entry: a SQL injection in LangGraph's SQLite checkpoint implementation. LangGraph persists agent state - the running conversation and execution graph - as checkpoints, and this flaw lets an attacker manipulate the underlying SQL queries through metadata filter keys, rather than through the checkpoint content itself (The Hacker News, 27 Mar 2026). What can go wrong when these stack. Read individually, each CVE looks bounded - a file read here, a secret leak there. Read together, Tokarev's framing is the useful one: three independent paths converging on the same category of outcome, sensitive data leaving a production agent deployment (The Hacker News, 27 Mar 2026). A realistic chain: an attacker who can influence a prompt template (directly, or indirectly through content the agent ingests) uses the path-traversal flaw to read configuration files off the host. Those files often contain, or point to, the same environment secrets the deserialization bug can leak directly - API keys for the LLM provider, database credentials, third-party service tokens. Separately, if the deployment uses LangGraph's SQLite checkpointing to persist multi-turn agent state, the SQL injection gives an attacker a second, independent route into stored conversation history - including whatever the agent discussed with legitimate users, potentially spanning sessions. None of the three requires the attacker to have valid credentials to the application first. That is what elevates this from "a bug in a library" to a framework-level trust problem: the vulnerable surface is the orchestration layer itself, sitting underneath whatever authentication the application built on top of it. Why framework-level CVEs are a distinct risk class from runtime prompt injection. It's worth being precise about what kind of vulnerability this is, because the fix and the mitigation differ from the runtime threats most agent-security content focuses on. Indirect prompt injection is a runtime problem: an agent processes untrusted content and gets manipulated into taking an unintended action, and the defense is layered detection and least-privilege scoping applied continuously, session by session. A framework CVE like the three above is a supply-chain problem: the vulnerability exists in the orchestration code itself, independent of what any individual agent does at runtime, and the fix is a version bump, not a behavioral control. That distinction matters for how a team should triage exposure. A runtime prompt-injection control (content scanning, output validation) does nothing to close CVE-2026-34070's path-traversal hole - the flaw is in how the prompt-loading API resolves file paths, not in what a malicious prompt asks the agent to do. Conversely, patching the framework does nothing to stop a legitimate, unpatched agent from being manipulated by injected content at runtime. Both categories of control are necessary, and treating a framework patch as if it covers runtime risk (or vice versa) leaves a gap either way. Controls a platform team should apply. The single highest-leverage action is also the simplest: confirm your pinned versions. The patched releases are langchain-core >=1.2.22 (also backported to 0.3.81 and 1.2.5) and langgraph-checkpoint-sqlite 3.0.1 (The Hacker News, 27 Mar 2026). If your lockfile predates these, treat it as an active exposure, not a hygiene item for the next sprint. Beyond the patch itself, three structural controls reduce exposure to this entire class of framework-level vulnerability, independent of which specific CVE is in play: * Track framework dependencies like any other supply-chain risk. Agent orchestration frameworks now sit in the same trust position as web frameworks or serialization libraries did a decade ago - pin versions, subscribe to security advisories for the specific packages in your dependency tree, and treat a framework CVE as a production incident, not a documentation update. * Scope what the checkpoint store - or any persistence layer - can expose. A checkpoint database that holds full conversation history is a high-value target by design. Isolating it from broader network access and encrypting it at rest limits what a successful injection can retrieve even before the underlying bug is patched. The same logic that governs MCP server security - classify data by sensitivity, don't trust the default configuration - applies directly to checkpoint stores. * Validate untrusted content before it reaches a prompt template. CVE-2026-34070 is exploitable through a crafted prompt template; the deeper pattern is the same one behind indirect prompt injection - content an agent processes can carry structure the framework did not anticipate. Input-side scanning and template validation are complementary to patching, not a substitute for it. For teams building or operating agents with LangChain or LangGraph as the orchestration layer, these three controls sit alongside the broader identity, authorization, and audit-logging controls covered in the AI agent security guide - framework patching handles one class of risk; the surrounding controls handle what happens if a future, unpatched flaw is exploited before a fix ships. Frameworks with community-contributed extensions carry an adjacent risk worth flagging here too: an agent's dependency tree can include third-party packages with far less scrutiny than the core framework itself, a supply-chain pattern also documented for Agent Skills - vet what you pull in, not just what ships from the framework maintainer. Faq. Is LangChain still safe to use in production after these CVEs? Yes, if patched. The vulnerable versions predate the March 2026 fixes; deployments running langchain-core >=1.2.22 (or the 0.3.81 / 1.2.5 backports) and langgraph-checkpoint-sqlite 3.0.1 are not exposed to these three specific issues. Which CVE is most urgent to patch? CVE-2025-68664 ("LangGrinch," CVSS 9.3) is the highest severity - it directly leaks API keys and environment secrets - but all three should be treated as one patch cycle, since fixes ship together. Does this affect LangGraph's checkpointing feature specifically, or all of LangGraph? Only CVE-2025-67644 is LangGraph-specific, and it's scoped to the SQLite checkpoint implementation's handling of metadata filter keys - not every LangGraph deployment or persistence backend is implicated.

Accelerating Trellix's transformation with AI-native security engineering. By Joe Chen · August 10, 2026 Cybersecurity is at an inflection point. Recent Trellix research shows a 67% increase in AI-driven APT campaigns and a 300% increase in the monthly attack cadence, underscoring a fundamental shift in the speed and scale of today's threats. These increases have made one thing clear: incremental improvement isn't enough. Recent examples of OpenAI and Anthropic models breaking out of sandboxes further reinforce the new "machine speed" the cybersecurity industry is facing. Trellix is meeting this challenge head-on by enhancing how Trellix build, secure, and optimize its technology through AI-native security engineering. When I joined Trellix as CTO in May, the stakes couldn't have been clearer. Frontier AI models were changing traditional time-to-exploit, compressing it across the industry and forcing vulnerability management to evolve alongside it. Simultaneously, Trellix was navigating its own security matter that required a thorough, expedited review of its codebase, architecture, and supply chain. So Trellix leaned in all the way, moving from experimental AI-enabled pilots available to a few teams to a standardized AI-enabled framework for all teams. Trellix embraced frontier AI models to review its entire codebase on an accelerated timeline, and Trellix embedded AI-powered auditing directly into its development pipelines, so potential vulnerabilities surface earlier in the development process. What began as a response to an immediate challenge has become a catalyst for fundamentally elevating its engineering standards. The result is a hardened foundation and an evolved engineering philosophy embracing the modern landscape. Driving innovation with a secure AI adoption framework. With high-performance AI-native security engineering as its foundation, Trellix is guided by the principles of accelerated, intentional, and responsible adoption of leading-edge technology, where security isn't a constraint on innovation but the condition that makes it sustainable. Here are a few examples of how Trellix is putting shift-left AI security into practice: * Trellix has retooled its engineering system around AI, not as a layer on top of existing processes, but woven into how Trellix build. Features will ship in smaller, highly validated increments. * AI capabilities and frontier models now identify and remediate vulnerabilities earlier in the software development lifecycle. Trellix is embracing a simplified architectural philosophy: AI maintains visibility throughout the development cycle, and secure-by-design principles remain at the forefront. * Trellix has also established strategic partnerships with two leading AI companies: Anthropic and LangChain. These aren't just vendor agreements; they're foundational alignments for its engineering and research teams. These partnerships grant Trellix privileged access to cutting-edge models, frameworks, observability, and roadmaps as they evolve, and its spend commitment with Anthropic, signed in May, signals the depth of its investment in this space. * Trellix is embracing both closed and open-source AI models for various tasks, depending on which is best suited, adapting to the new pace of AI innovation. AI amplifies what its engineering teams have always prioritized, bringing continuous intelligence and real-time visibility to its rigorous security practices, so its engineers can direct more of their expertise toward innovation, architecture, and customer outcomes. Leading the next era of cyber defense. Trellix has a lot of work to do, but Trellix is at the beginning of what I believe will be a defining chapter, not just for Trellix, but for the broader industry. The organizations leading the next era of cyber defense aren't the ones who add AI to their slide decks. They're the ones willing to rebuild their engineering foundations to make AI native to how they think, build, and protect. Its mission is clear: set the standard for high-performance engineering, responsible AI adoption, and the kind of customer trust that can be earned only through consistent execution. The threat landscape will keep evolving. So will Trellix.