Check Point researchers have found 11 vulnerabilities, some critical, across major AI agent frameworks including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, revealing that the security failure lies not in prompt injection itself but in how these frameworks handle it. The researchers argue that a bug in one agent framework amounts to a bug in the underlying layer that an entire category of AI applications relies on, meaning defenders should assume prompt injection will happen and instead focus on stopping attacker-controlled content from crossing into trusted framework logic such as orchestration, memory and system instructions.

Speaking ahead of a Black Hat talk, researchers Yarden Porat and Shahar Tal said the flaws they uncovered over a year of testing were mostly well-known bug classes, including insecure deserialization, server-side request forgery, path traversal and use-after-free issues, rather than novel AI-specific weaknesses. One notable example was a critical checkpoint deserialization flaw in Microsoft Agent Framework that could let an attacker plant a malicious payload via a message, which then executes when another user's session reloads that saved state, granting remote code execution. Microsoft paid a $10,000 bug bounty and has since released hardening protections, though no CVE was issued as the framework was not yet generally available when the flaw was found.