AI Agent Frameworks Face Security Crisis

The security of modern artificial intelligence is often discussed through the lens of prompt injection, but new research indicates that the true danger lies in the architecture surrounding these models. Rather than focusing on a single vendor or application, security experts are highlighting systematic flaws in the underlying agent frameworks that enterprises rely on to build and deploy their automated systems.

Foundational Flaws in Frameworks

Researchers at Check Point spent a year investigating common tools including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. Their analysis suggests that a significant security failure is occurring where user-controlled content is permitted to cross the boundary into trusted framework logic. This transition allows injected input to manipulate essential components like orchestration, memory, state management, routing, and system instructions.

Unlike vulnerabilities specific to a single AI model, these issues affect the entire layer upon which a broad category of applications runs. The researchers emphasize that these frameworks frequently fail to isolate attacker-controlled data, effectively turning the plumbing of the AI stack into an attack vector.

Our research shows a deeper failure: in many agentic frameworks, prompt-controlled content can cross the boundary into trusted framework logic itself.

— Yarden Porat and Shahar Tal, researchers at Check Point.

Legacy Vulnerabilities Reappearing

The study found that the security challenges plaguing these advanced frameworks are not entirely new. Instead, they are familiar problems that have been well-documented in traditional software development for decades. The researchers identified 11 vulnerabilities across the tested frameworks, categorizing them as classic flaws that have been ported into the modern AI ecosystem.

• 11 vulnerabilities disclosed across frameworks.
• $10,000 bug bounty paid by Microsoft.
• $3,133.70 bug bounty paid by Google.
• $17,133.70 total in rewards received by researchers.

Specific Exploitation Paths

A notable example involved the Microsoft Agent Framework, where an insecure checkpoint deserialization issue was identified. Because agents use checkpoints to save state or rewind task progress, they often serialize data into persistent storage. The researchers discovered that an attacker could use prompt injection to load untrusted checkpoint data, enabling remote code execution. While Microsoft released updated protections, the issue did not receive a formal CVE because it was not considered a generally available product at the time.

Similarly, the team identified issues within the Google ADK, involving a development assistant that remained accessible over an HTTP API without authentication. This allowed for the execution of unauthorized code that could potentially access environment API keys and Google Cloud service accounts. Despite initial resistance to classifying the issue as a bug, Google provided a partial fix following the disclosure.

Implications for Enterprise Security

For organizations, this research suggests that focusing solely on prompt injection defenses may be insufficient. Because these frameworks are designed to read emails, update databases, and manage sensitive system processes, the reliance on the underlying integrity of the framework is absolute. If these layers remain insecure, standard defenses may fail to prevent malicious actors from gaining control over the systems themselves. As businesses accelerate the adoption of these tools, the reliance on potentially vulnerable frameworks could present a significant, ongoing security risk.