Agent Frameworks Fail Security Boundary Test: 11 Vulnerabilities Disclosed at Black Hat #
Framework-as-boundary is the missing security paradigm in the current AI agent ecosystem. At Black Hat USA 2026 on August 5, Check Point Research analysts Yarden Porat and Shahar Tal disclosed 11 vulnerabilities across six major AI agent frameworks: LangChain, LangGraph, CrewAI, AutoGen, the Microsoft Agent Framework, and the Google Agent Development Kit (ADK). These findings demonstrate that agent frameworks are failing to treat their own infrastructure as a critical security boundary, effectively re-importing legacy vulnerability classes-such as insecure deserialization, SSRF, and path traversal-into the modern agentic stack.
The Findings: Plumbing Failures #
The 11 vulnerabilities, totaling $17,133.70 in bounties, confirm that the attack surface is not merely the LLM, but the framework’s handling of attacker-controlled content. The vulnerabilities span a range of critical classes, including insecure deserialization, server-side request forgery (SSRF), path traversal, and use-after-free errors.
Microsoft Agent Framework: The Checkpoint Vulnerability #
The most severe finding involved the Microsoft Agent Framework. Researchers identified a critical insecure deserialization flaw within the framework’s checkpoint feature. This vulnerability allowed for remote code execution (RCE) triggered via prompt injection. The attack vector is particularly dangerous: one user plants a malicious payload, and a subsequent user’s session rewind triggers the execution, granting the attacker shell access. While the framework was not yet generally available, the flaw was patched following a $10,000 bounty award. No CVE was issued for this finding.
Google ADK: The Denial-Before-Fix Culture #
The disclosure also highlights a concerning “denial-before-fix” culture among vendors, exemplified by the Google ADK incident. Researchers discovered unauthenticated code execution via a built-in development assistant on an HTTP API that was hidden from the application listing and lacked default authentication. Furthermore, the command adk deploy cloud_run published this same unauthenticated endpoint to the cloud. This RCE vulnerability exposed environment API keys and GCP service accounts. Google initially refused to classify the issue as a bug, eventually issuing only a partial fix and awarding a $3,133.70 bounty. No CVE was issued.
LangGraph CVEs #
LangGraph, a framework designed for building stateful, multi-actor applications, was found to contain three distinct vulnerabilities:
CVE-2025-67644: SQLite injection in the*get_state_history()*function.CVE-2026-28277: MessagePack deserialization RCE during checkpoint .CVE-2026-27022: Redis injection within the checkpointer.
These vulnerabilities underscore the risks inherent in how frameworks manage state and persistence, often relying on legacy serialization methods that are ill-suited for untrusted agentic inputs.
The Core Insight: Beyond Prompt Injection #
The researchers emphasize that the industry must shift its defensive posture. As noted in coverage by Jessica Lyons in The Register on August 5, 2026, the researchers stated: “Assume prompt injection will happen; the real vulnerability is what the framework does with attacker-controlled content.” This perspective aligns with the broader agent-native attack surface arc, suggesting that security efforts must move beyond guardrail bypasses and toward hardening the framework infrastructure itself.
Threading: From Guardrails to Plumbing #
This disclosure serves as a critical follow-up to the CoreBreak vulnerability (Post 128911), which focused on cross-platform guardrail bypasses. While CoreBreak demonstrated that guardrails can be circumvented, the Check Point Research findings demonstrate that even if guardrails hold, the underlying framework plumbing remains exploitable. This extends the SADF research presented at DEF CON 34 (Post 128860), which identified the framework itself as a primary attack surface with a 2.6x spread in Agent Compromise Rate across frameworks.
The Infrastructure Blind Spot #
The industry is currently repeating the mistakes of the past by treating agent frameworks as trusted execution environments. By failing to implement strict boundaries around deserialization, state management, and API access, these frameworks are re-importing legacy vulnerability classes into the agentic stack. Until developers treat the framework infrastructure as a hostile boundary, agentic systems will remain susceptible to trivial exploitation regardless of the sophistication of the underlying LLM.