The short answer
At Black Hat 2026 Check Point Research disclosed around eleven vulnerabilities across the AI agent frameworks most teams build on — LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK — and the headline is not prompt injection. It is that these frameworks routinely let attacker-controlled content escape the data plane and reach trusted logic: orchestration, memory, routing, state handling and system instructions. That is how a text prompt becomes an SSRF request, a deserialized object, a rogue file write or a shell command.
The bug classes are old — insecure deserialization, SSRF, path traversal, use-after-free — but they are far more dangerous here because agent frameworks hold API keys, database credentials and broad tool access. One Microsoft Agent Framework flaw reached remote code execution through untrusted checkpoint loading. If your roadmap has autonomous agents on it, the practical lesson is blunt: treat the framework itself as untrusted input-handling code, not as safe internal plumbing.
What Check Point actually found
Presenting at Black Hat 2026, Check Point Research laid out roughly a dozen flaws — several rated critical — spread across the frameworks that dominate agent development: LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK. None of the individual bugs is exotic. They are the same categories application-security teams have chased for two decades: insecure deserialization, server-side request forgery (SSRF), path traversal and use-after-free. What changed is the context in which they now live.
The most severe example came from Microsoft's Agent Framework: an insecure-deserialization issue where, triggered through prompt injection, the agent loaded untrusted checkpoint data and could be steered into executing attacker code — a remote-code-execution path estimated at critical severity. Microsoft acknowledged the report, paid a 10,000 US dollar bug bounty and fixed the flaw, though it issued no CVE because the framework was not yet a generally available product when Check Point reported it. Elsewhere, researchers found a Google ADK file-writing assistant that was reachable over plain HTTP by default — an agent capability exposed to the network with no authentication in front of it. For teams already building AI agent workflows, these are not edge cases; they are the default wiring of quick-start tutorials.
Why old bugs get worse inside agents
To see why a familiar deserialization bug is scarier in an agent, look at what an agent framework actually holds. It is not a stateless request handler. It carries the model's API keys, the credentials for the databases and SaaS tools the agent can call, its conversation memory, and often direct paths into internal networks. Check Point's earlier work on LangGraph made the stakes concrete: a compromised LangGraph server exposed LLM API keys, customer data, CRM credentials, conversation history and internal network access at once. The framework is a high-trust chokepoint, so any code-execution bug inside it inherits all of that trust.
The mechanism that makes it exploitable is the boundary failure Check Point keeps returning to. In a normal app, user input is data and stays data. In these agent frameworks, attacker-controlled prompt content can slip out of the data plane and influence control flow — which tool runs next, what gets deserialized from memory, which URL the agent fetches, what path it writes to. That is the earlier LangGraph checkpointer chain in a nutshell: a SQL injection (CVE-2025-67644) seeded a malicious checkpoint, and an unsafe msgpack deserialization (CVE-2026-28277) turned that checkpoint into remote code execution, with a parallel Redis-injection variant (CVE-2026-27022). The fixes landed in langgraph 1.0.10 and later, langgraph-checkpoint-sqlite 3.0.1+ and langgraph-checkpoint-redis 1.0.2+ — but the shape of the attack is what generalizes.
Why this is a pattern, not a single CVE
The reason to treat this as an architectural warning rather than a patch note is that the same weaknesses show up independently across unrelated frameworks. When six different projects — from LangChain to Google's ADK to Microsoft's Agent Framework — all leak the data/control boundary in similar ways, the cause is not one careless maintainer. It is that the whole ecosystem grew up optimizing for capability and developer speed, wiring memory, tools and routing together with implicit trust, before anyone treated the orchestration layer as a security boundary. Microsoft's own security team flagged the same “prompts become shells” class of RCE earlier in 2026; Check Point's disclosure shows it is systemic.
That framing matters because it changes where you spend effort. If you believe prompt injection is the disease, you pour resources into input filtering and guardrail prompts — necessary, but never complete, because a determined injection will get through. If you accept that the injection is just the delivery van and the real problem is what the framework does with the payload, you invest in the boundaries that actually contain damage: never deserializing untrusted state, authenticating every agent endpoint, and giving each agent the narrowest possible credentials and network reach. The first approach tries to win an unwinnable input-sanitization race; the second limits the blast radius when the race is lost.
What it means for US & EU software teams
The first implication is that agent frameworks belong in your application-security scope now, not in a separate “AI experiment” bucket. The components teams treat as internal plumbing — checkpointers, memory stores, routers, tool loaders — are exactly the input-handling paths Check Point exploited. They deserve the same threat modeling, dependency pinning and penetration testing and security audits you already apply to your web tier. If your pen-test scope stops at the API gateway and never touches the agent runtime, it is testing the wrong perimeter.
The second is a compliance point that hits regulated work hardest. An agent that can read production data through a framework carrying unscoped credentials is a control gap, and a remote-code-execution bug in that framework is a reportable incident waiting to happen. For FinTech and HealthTech teams, the controls you put around agent frameworks — least-privilege identities, egress allowlists, sandboxed deserialization, an audit trail of tool calls — are also the evidence auditors expect under SOC 2, DORA and the EU AI Act. Documenting them once serves both security and the regulator.
The third is architectural discipline that costs little if you do it early and a lot if you do it late. Give every agent its own scoped, least-privilege credentials instead of a shared master key, so a hijacked agent cannot reach your whole estate. Put an egress allowlist in front of agent tool calls so an SSRF cannot pivot to internal services. And never load checkpoints, memory or serialized state from a source you do not fully control. Teams that build these constraints into the platform and DevOps layer from the start absorb the next framework CVE as a routine update; teams that skip them inherit an untraceable, over-privileged mesh that is expensive to unwind.
What to do now
You do not need to swap frameworks this quarter. You do need to stop treating the agent runtime as trusted internal code. Here is the shippable version.
- Inventory and pin your frameworks. List every agent framework and version in production and update to the patched releases (for LangGraph, that means langgraph 1.0.10+, checkpoint-sqlite 3.0.1+, checkpoint-redis 1.0.2+).
- Subscribe to each framework's security advisories. Treat framework CVEs like you treat runtime and OS patches, with an owner and an SLA.
- Never deserialize untrusted state. Checkpoints, memory and serialized objects from any source you do not control are code-execution risks; validate or sandbox them.
- Authenticate every agent endpoint. No agent capability — file writers, tool servers, admin routes — should be reachable over plain HTTP without auth.
- Scope credentials and egress. Give each agent least-privilege keys and an outbound allowlist so injection cannot pivot to your whole network.
- Add agents to your security testing. Bring the agent runtime into threat modeling and pen-test scope, and keep a tool-call audit trail for SOC 2, DORA and the EU AI Act.
None of this is a verdict against LangChain, CrewAI or the others — they are mainstream tools worth using. The durable takeaway is architectural: as agents move from answering to acting, the framework that wires them together is now security-critical code, and the teams that model it as untrusted today will spend far less cleaning up after the next disclosure.
Frequently asked questions
What did Check Point Research disclose at Black Hat 2026?
Check Point Research disclosed roughly a dozen vulnerabilities (around 11) across the most widely used AI agent frameworks, including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK. The flaws are classic software bug classes — insecure deserialization, SSRF, path traversal and use-after-free — that become far more dangerous inside frameworks holding API keys, credentials and data access. One Microsoft Agent Framework issue allowed remote code execution via untrusted checkpoint loading (estimated CVSS 9.8); Microsoft paid a $10,000 bounty and fixed it, but issued no CVE because the framework was not a generally available product at disclosure. A Google ADK file-writing assistant was reachable over HTTP by default.
Is this the same as prompt injection?
No. Check Point's central point is that prompt injection is only the delivery mechanism. The real vulnerability is what the framework does with the injected content: instead of keeping attacker-controlled text confined to the data plane, the frameworks often let it flow into trusted logic — orchestration, memory, routing, state handling and system instructions. That is what turns a text prompt into an SSRF request, a deserialized object, a file write or a shell command. The bug lives in the middleware, not the model.
Which AI agent frameworks are affected?
The disclosure names LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK — the frameworks most teams reach for first. An earlier Check Point chain in LangGraph combined a SQL injection (CVE-2025-67644), an unsafe msgpack deserialization giving remote code execution (CVE-2026-28277) and a Redis injection (CVE-2026-27022) through the checkpointer, fixed in langgraph 1.0.10+, langgraph-checkpoint-sqlite 3.0.1+ and langgraph-checkpoint-redis 1.0.2+. The pattern, not any single library, is the story: the same weaknesses recur across the ecosystem.
Do we need to stop using LangChain, CrewAI or AutoGen?
No. These are mainstream, actively maintained frameworks and the responsible move is to patch, not to rip them out. Update to the fixed releases, subscribe to each framework's security advisories, and treat the framework itself as attack surface: never load checkpoints, memory or serialized state from untrusted sources, do not expose agent HTTP endpoints without authentication, and put agent tool calls behind egress controls. The goal is to stop treating the orchestration layer as trusted internal plumbing.
What should engineering teams do now?
Inventory every agent framework and version in production and pin them to patched releases. Model the framework's own components — memory stores, checkpointers, routers, tool loaders — as untrusted input paths, and validate or sandbox anything deserialized. Give agents scoped, least-privilege credentials and network egress allowlists so a hijacked agent cannot reach your whole estate. Add these paths to your existing application-security testing and pen-testing scope. For regulated FinTech and HealthTech work, document the controls as evidence for SOC 2, DORA and the EU AI Act.
Sources
The Register — Prompt injection isn't the bug, AI agent frameworks are
Check Point Blog — When your AI agent's memory becomes a security liability
Check Point Research — From SQLi to RCE: exploiting LangGraph's checkpointer
Microsoft Security Blog — When prompts become shells: RCE vulnerabilities in AI agent frameworks