Nearly a dozen flaws, some critical, in major AI agent frameworks that enterprises use to build apps reveal a security failure that extends beyond prompt injection – or any single model – according to Check Point researchers.<\/p>\n
\u201cOur research shows a deeper failure: in many agentic frameworks, prompt-controlled content can cross the boundary into trusted framework logic itself,\u201d Yarden Porat and Shahar Tal note in a write-up about a Wednesday Black Hat talk on post-injection exploitation across AI agent frameworks, which they also discussed with The Register.<\/p>\n
\u201cA bug in an agent framework isn’t a bug in one product – it’s a bug in the layer a whole category of AI apps runs on,\u201d Tal told us. \u201cAnd the agent needs no dangerous tools to be turned against you: reading the wrong document is enough. We\u2019re building this layer faster than we know how to defend it.\u201d\u2028<\/p>\n
The researchers spent a year trying to break various frameworks that enterprises use including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. And across these frameworks, the team found and disclosed 11 vulnerabilities.<\/p>\n
\u201cAlmost none of it was a completely new bug class,\u201d Tal said. \u201cThat’s insecure deserialization, server-side request forgeries, path traversals, use-after-free. These are bugs that we learned to fix 20 years ago, and they’re sitting underneath agents that now read your inbox, or update your database.\u201d<\/p>\n
These are old types of threats, and the model isn\u2019t the weak link, he added. The failure exists in the \u201cplumbing around the model, and we think this has been overlooked,\u201d Tal told us. \u201cThere\u2019s a lot of research going into prompt injection and defenses, which are important, but that\u2019s just the beginning.\u201d<\/p>\n