Researchers have identified nearly a dozen critical vulnerabilities in several prominent AI agent frameworks, including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. These flaws, discovered by Check Point researchers Yarden Porat and Shahar Tal, highlight a systemic security issue in the underlying architecture of AI applications, extending beyond mere prompt injection attacks. The findings were presented at a recent Black Hat conference.
The researchers spent a year investigating these frameworks and found 11 vulnerabilities, many of which are familiar bug classes such as insecure deserialization, server-side request forgeries, path traversals, and use-after-free errors. According to the researchers, these are vulnerabilities that security professionals learned to address decades ago, yet they are now appearing in the foundational layers of AI agents that handle sensitive data and operations. The core problem, they argue, is not the AI model itself, but the "plumbing around the model" that has been overlooked in the rapid development of these frameworks.
A critical insecure deserialization vulnerability was discovered in the Microsoft Agent Framework. This flaw allowed attacker-controlled content, introduced via prompt injection, to cross the security boundary into trusted framework logic. Specifically, the agent's checkpoint mechanism, which saves and reloads an agent's state, could be exploited. An attacker could plant a malicious payload in a message, and when another user's session was rewound to an earlier state, the payload would be triggered, leading to remote code execution on the server. Microsoft confirmed the findings, paid a $10,000 bug bounty, and released protections to harden the framework. However, because the framework was not generally available at the time of discovery, a CVE was not issued. Microsoft stated that it updated the specific checkpoint file with additional language to define the security boundary.
Similar issues were found in Google ADK (Agent Development Kit). The researchers identified a vulnerability where ADK's built-in development assistant, capable of writing files, remained accessible via an HTTP API even when hidden from the application listing. An attacker could exploit this by creating a session, instructing ADK to write an agent with Python code that executes at import time, and then requesting the server to run this agent. Since there is no authentication on this API by default, and `adk deploy cloud_run` publishes the same API, a default Cloud Run deployment could be compromised without credentials, potentially granting access to environment API keys and the container's Google Cloud service account. Google initially disputed the severity of the issue, but after further argumentation from the researchers regarding the potential for secret theft, paid a $3,133.70 bounty and implemented a partial fix.
In total, the researchers received $17,133.70 in bug bounties for their disclosures. The prevalence of these "old" bug classes across multiple frameworks suggests a widespread oversight in the security practices applied to AI agent development. The researchers emphasize that the problem is not isolated to a single vendor but represents a common failure in how these critical AI application layers are being constructed.
