11 flaws in the AI agent frameworks you build on

Most advice about agent security is about prompts: sanitize the input, add a guardrail model, tell the LLM not to obey instructions in retrieved text. Check Point researchers spent a year testing that premise against the actual code and came back with a different answer. Presenting at Black Hat 2026, Yarden Porat and Shahar Tal disclosed 11 vulnerabilities across the AI agent frameworks enterprises actually build on — and the bugs weren't in the model. They were in the plumbing.

What actually happened

Per The Register, the team probed LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. What they found were not exotic AI attacks. They were insecure deserialization, server-side request forgery, path traversal, and use-after-free — bug classes that predate transformers by decades, sitting in the middleware that routes, stores, and replays agent state.

Two examples show the shape of it. Microsoft Agent Framework carried a critical checkpoint deserialization flaw that allowed remote code execution when loading untrusted checkpoint data. It earned a $10,000 bounty and a hardened fix, but got no CVE — the framework wasn't generally available when it was found. Google ADK shipped a built-in development assistant that was hidden from the app listing but still reachable over its HTTP API, unauthenticated by default, with the ability to write files. Google initially closed it as "not a bug," then issued a partial fix and a $3,133.70 bounty. Total bounties across the disclosure: $17,133.70.

The researchers' framing is the part worth internalizing. Prompt injection is the delivery mechanism, not the vulnerability. The real failure is a boundary problem: attacker-controlled content crosses out of the data plane and into trusted framework logic — memory, routing, state handling — where it's no longer treated as untrusted at all. Patch the prompt and the boundary is still broken.

This lands weeks after CISA added Langflow's CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. The pattern is now hard to miss.

Why AI agent framework security matters for your business

If you have shipped anything agentic in the last eighteen months, you almost certainly pulled in one of these six. They are the default answer to "how do we orchestrate this," and they went into production during a stretch when nobody was reading their source.

Practical implications:

Your agent framework is a dependency, not a magic layer. It needs the same treatment as any other server-side package: pinned versions, an SBOM entry, dependency alerts, and a patch window. Check what you're running today and what version.

Checkpoint and memory stores are the soft spot. Several of these bugs live where agent state gets serialized and reloaded. If your agent persists state to SQLite, Redis, or disk — and anything user-influenced reaches that path — treat it as an injection surface, not a cache.

Don't expose the dev surface. The Google ADK finding is the one most likely to bite a small team verbatim: a helper endpoint that exists for local development, unauthenticated, still routable in a deployed environment. Audit what your agent host actually listens on.

Scope the credentials. The framework will eventually have a bug. What determines whether that's an incident or a footnote is what the agent's token could reach when it fired. Least privilege per agent, per tool, with an audit trail.

Sources: The Register, Check Point Research.