AI agent frameworks exposed by 11 old-school flaws

Eleven vulnerabilities found across widely used AI agent frameworks point to a security problem deeper than prompt injection or any individual model, according to Check Point researchers.

The researchers spent a year testing LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. They found and disclosed 11 flaws, including vulnerabilities that could enable remote code execution, server-side request forgery, path traversal, insecure deserialization, and use-after-free attacks.

“A bug in an agent framework isn’t a bug in one product — it’s a bug in the layer a whole category of AI apps runs on. And the agent needs no dangerous tools to be turned against you: reading the wrong document is enough. We’re building this layer faster than we know how to defend it.”

Prompt injection is only the starting point

Check Point’s Yarden Porat and Shahar Tal presented their findings at a Wednesday Black Hat talk and discussed them with The Register. Their central argument is that defenders should assume prompt injection will happen. The critical question is what the framework does with attacker-controlled content afterward.

In the vulnerable systems, content from prompts or documents could cross from the data plane into trusted framework logic. That allowed it to affect orchestration, memory, state, routing, and system instructions. The model itself was not necessarily the weak point; the surrounding infrastructure was.

“Almost none of it was a completely new bug class. That’s insecure deserialization, server-side request forgeries, path traversals, use-after-free. These are bugs that we learned to fix 20 years ago, and they’re sitting underneath agents that now read your inbox, or update your database.”

That distinction matters for teams deploying coding agents and business workflows. As ReasonGate’s prompt-injection defenses show, blocking malicious instructions is one layer of protection. The Check Point research suggests that frameworks also need strong boundaries around the state, tools, and APIs that process the content an agent reads.

Recommended reading

Snowflake attacker pleads guilty in massive data theft

Microsoft checkpoint flaw enabled code execution

The most severe example involved a critical checkpoint deserialization vulnerability in Microsoft Agent Framework. Agents use checkpoints to save snapshots of their state or task progress, including conversation history, in persistent storage. They can later reload that data after an error or when a user rewinds a session.

Check Point found that prompt injection could cause the agent to load an untrusted checkpoint. A malicious payload inserted by one user could then execute when another user rewound their own session:

“One person’s message plants the payload, and then a different person rewinds their own session, which triggers the payload, and now the attacker has a shell on that server.”

Microsoft acknowledged the finding, paid a $10,000 bug bounty, and released protections to block the demonstrated exploitation path. The company also updated the relevant checkpoint file with language defining its security boundary.

Microsoft did not issue a CVE because the framework was not a generally available product when Check Point discovered the flaw. That leaves the precise scope of the affected pre-release software less clear than it would be for a broadly deployed, catalogued vulnerability.

Google ADK left an unauthenticated route exposed

The researchers also found a trust-boundary problem in Google ADK, which includes a development assistant capable of writing files. Porat said that assistant remained reachable through an HTTP API even though it was hidden from the application listing.

An attacker could open a session, ask ADK to write an agent containing Python code that runs during import, and then ask the server to execute it. The server would import the file and run the attacker’s code.

Check Point said the API had no authentication by default. It also said that adk deploy cloud_run publishes the same API, making it reachable without credentials in a default Cloud Run deployment. From there, the code could reach environment API keys and the container’s Google Cloud service account.

Google did not respond to The Register’s inquiries. Check Point said Google initially considered the issue not to be a bug, but later paid a $3,133.70 bounty and issued a partial fix. The researchers said they focused on the consequences — code execution leading to secret theft — rather than treating the issue as merely a developer inconvenience.

The reported rewards totaled $17,133.70. Check Point’s broader conclusion is not that one framework is uniquely unsafe: the same older vulnerability classes appeared across the systems tested. For enterprise agent builders, prompt injection should therefore be treated as an expected input, while framework isolation, authentication, serialization, and state handling become the security controls that determine whether that input stays data or reaches the machine.