Agent Framework Vulnerabilities: Black Hat 2026

At Black Hat USA 2026, Check Point Research presented a year of work spent deliberately breaking the frameworks that enterprises build AI agents on.¹² The talk's title gives away the finding: No Tools Required. The agent does not need a dangerous tool to be turned against you.

In one line: Check Point disclosed roughly a dozen vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Google ADK and Microsoft Agent Framework — and almost none were new bug classes. They were insecure deserialization, SSRF, path traversal and use-after-free, sitting inside the orchestration layer a whole category of AI apps runs on.

TL;DR

• Check Point researchers Shahar Tal and Yarden Porat audited the major agent frameworks for a year. The Register, briefed before the talk, reported 11 vulnerabilities across six frameworks; Check Point's own post-talk recap says 12 CVEs across four.¹² Both figures come from the same two researchers — see the count discrepancy below.
• The core claim is a boundary failure, not a model failure. Attacker-controlled content crosses out of the data plane and into framework internals — serialization, caching, file parsers, memory, routing.²
• Microsoft Agent Framework: an insecure checkpoint deserialization bug led to RCE. One user plants a payload in a message; a different user rewinds their session and the payload fires. Microsoft paid a $10,000 bounty and shipped a fix, but issued no CVE because the framework was not generally available when the bug was found.¹
• Google ADK: Check Point reported that a built-in development assistant capable of writing files stays reachable over the HTTP API with no authentication by default — including on a default adk deploy cloud_run deployment. Google initially deemed it not a bug, then paid $3,133.70 and issued a partial fix.¹
• Same pair, second talk: five memory-corruption bugs in workerd, the runtime behind Cloudflare Workers and Code Mode. Two rated Critical. One chain went from prompt injection to full sandbox escape.²³
• Meanwhile the theory is already practice. Langflow's CVE-2026-9198 (CVSS 9.8) entered CISA's Known Exploited Vulnerabilities catalog on August 4, 2026, with a federal patch deadline of August 7.⁴⁵

What You'll Learn

• What Check Point actually found, and why the two published counts differ
• The specific Microsoft Agent Framework and Google ADK weaknesses, and how each vendor responded
• Why the LangGraph CVE chain is the clearest worked example of the pattern
• How Langflow's actively exploited RCE proves the framework layer is already a live target
• What the Cloudflare workerd findings mean for "just run the agent in a sandbox"
• A concrete checklist for teams running self-hosted agent frameworks

The finding: prompt injection is the delivery, not the payload

Prompt injection is a delivery mechanism. The actual vulnerability is what the framework does with the injected content once it has it.

That is the reframing Check Point brought to Las Vegas. Defenders should assume injection will happen, the researchers argue; the bug is that frameworks fail to keep attacker-controlled content inside the data plane.¹

Once it escapes, it influences trusted orchestration, memory, state, routing and system instructions — parts of the stack that were never written to handle hostile input.²

"A bug in an agent framework isn't a bug in one product — it's a bug in the layer a whole category of AI apps runs on," Shahar Tal told The Register.¹

He added the line that sharpens it: "And the agent needs no dangerous tools to be turned against you: reading the wrong document is enough. We're building this layer faster than we know how to defend it."¹

The bug classes are the least exotic part of the story.

"Almost none of it was a completely new bug class," Tal said. "That's insecure deserialization, server-side request forgeries, path traversals, use-after-free. These are bugs that we learned to fix 20 years ago, and they're sitting underneath agents that now read your inbox, or update your database."¹

The model, in other words, is not the weak link. The failure lives in what Tal called the "plumbing around the model, and we think this has been overlooked."¹

The count discrepancy

Two numbers are in circulation, and it is worth being precise about which is which.

The Register, which interviewed Tal and Porat ahead of the Wednesday talk, reported that they tested LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK and "found and disclosed 11 vulnerabilities."¹

Check Point's own recap, published the following day, says the pair audited LangChain, Google's ADK, Microsoft Agent Framework and CrewAI and that "across the four, they found 12 CVEs."²

Both accounts trace to the same researchers, so the gap is likely a scoping difference rather than a contradiction — vulnerabilities and CVEs are not the same unit of measurement, and Check Point's own reporting confirms at least two of the findings received no CVE at all.¹ Treat "roughly a dozen findings across four to six frameworks" as the defensible summary until the technical write-ups land on research.checkpoint.com.²

Microsoft Agent Framework: the checkpoint that ran your code

Agents save checkpoints — serialized snapshots of state and conversation history — so a failed run can resume instead of restarting.

Check Point found an insecure deserialization flaw in how Microsoft Agent Framework loaded that checkpoint data.

The exploitation path is the part worth internalizing, because no one has to call a dangerous function on purpose.

"One person's message plants the payload, and then a different person rewinds their own session, which triggers the payload, and now the attacker has a shell on that server," Tal explained.¹

Microsoft acknowledged the report, paid a $10,000 bounty and fixed the issue. A spokesperson told The Register the company "released protections to harden the Agent Framework and prevent the concrete exploitation path demonstrated in the proof of concept," and updated the checkpoint encoding file with language defining the security boundary.¹

No CVE was issued, because the framework was not a generally available product at the time of the finding.¹ Microsoft Agent Framework has since reached GA — we covered that release — which makes the absence of a tracked identifier a real gap for anyone auditing dependencies.

Google ADK: the dev assistant that shipped to production

Google's Agent Development Kit ships a built-in development assistant capable of writing files.

"It stays reachable over the HTTP API even though it is hidden from the app listing," Yarden Porat told The Register.¹

The exploit needs no memory corruption and no clever primitive. An attacker opens a session, asks ADK to write an agent whose Python code executes at import time, then asks the server to run it. The server imports the file and runs the attacker's code.¹

The default posture is what makes this severe.

"There is no authentication on that API by default, and adk deploy cloud_run publishes the same API, so on a default Cloud Run deployment it is reachable without credentials," Porat said. "From there it reaches the environment's API keys and the container's Google Cloud service account."¹

Google initially deemed the issue not a bug, according to Check Point. The researchers said they had to argue impact rather than mechanism — code execution on that container reaches environment API keys and the container's service account, which is secret theft, not developer inconvenience.¹

Google ultimately paid $3,133.70 and issued a partial fix, according to Check Point. Google did not respond to The Register's inquiries.¹

Bounties across the whole research effort totalled $17,133.70 — more than the Microsoft and Google awards combined, so other vendors paid out too, though The Register does not break those out.¹

LangGraph: the clearest worked example

If you want the pattern in one attack chain, Check Point's earlier LangGraph disclosure is the cleanest illustration — and unlike the Microsoft and Google findings above, these carry tracked CVE identifiers.

Three flaws were assigned identifiers, all credited to Porat.⁶⁷

Table: LangGraph checkpointer CVEs disclosed by Check Point Research. Sources: The Hacker News (CVSS scores, affected packages) and Check Point Research (chaining analysis).

None of the three individually clears CVSS 7.5. The severity is emergent.

Chained, CVE-2025-67644 and CVE-2026-28277 produce remote code execution.⁶ The attacker crafts a msgpack payload, uses the SQL injection in a get_state_history() filter to return a fake checkpoint row containing that payload, and the application deserializes it on read.⁶

"Individual bugs get caught. Chains get missed," as Check Point put it in its own write-up.⁷

Scope matters here too. The chain is exploitable in self-hosted deployments using the SQLite or Redis checkpointer with a user-controlled filter input. LangChain's managed platform, LangSmith Deployment, is not affected.⁶⁷

LangGraph's maintainers characterize CVE-2026-28277 as a post-exploitation issue that requires an attacker to already have write access to the checkpoint persistence layer — a condition they say typical hosted configurations are designed to prevent.⁶ That is a fair caveat, and it is also exactly the access the SQL injection was designed to grant.

Check Point put LangGraph at roughly 46.5 million downloads in the month before its June 11, 2026 disclosure.⁷

Langflow proves it is not theoretical

The Black Hat findings were responsibly disclosed and largely patched. Langflow shows what happens when a framework bug reaches the wild first.

CVE-2026-9198 is a CWE-94 code injection flaw in IBM Langflow OSS 1.0.0 through 1.10.0, scored CVSS v3.1 9.8.⁴

The chain is two endpoints. /api/v1/auto_login is not bound to loopback and mints SUPERUSER tokens for any network caller. /api/v1/validate/code then evaluates attacker-supplied Python through exec().⁴

That is unauthenticated remote code execution on a default deployment — no login, no user interaction, no prior access.⁴

IBM disclosed the flaw on July 17, 2026 and shipped 1.10.1 the same day.⁴ CISA added it to the Known Exploited Vulnerabilities catalog on August 4, 2026, giving federal civilian agencies until August 7 to patch.⁵

Telemetry cited by The Hacker News records 650 exploitation attempts from 244 unique IP addresses across 41 countries, beginning July 6 — before the public disclosure.⁵

Why it matters more than a normal RCE: Langflow is an agent-orchestration tool. It typically holds model-provider API keys, database credentials and connector tokens for every flow it runs.⁴ Code execution on the host is code execution against the whole credential set.

The sandbox is not the answer either

The obvious mitigation is to run agent-generated code in a sandbox. Cloudflare's Code Mode takes exactly that bet: let the model write a small program, then run it inside a locked-down runtime.

Tal and Porat went after the runtime instead of the model.

They found five memory-corruption vulnerabilities in workerd, the open-source runtime behind both Code Mode and Cloudflare Workers. Cloudflare rated two of them Critical.²³

One was a flaw in URLPattern that let an attacker cross the tenant boundary and read a neighbouring customer's secrets out of shared memory — with every defense enabled.²

The second was a use-after-free in node:zlib, chained to arbitrary memory read and write and from there to a full sandbox escape. The demonstration started from nothing more than a prompt injection.²

Cloudflare ran a full disclosure process and fixed the issues; self-hosted workerd and Code Mode deployments should be on v1.20260619.1 or later.²³ Check Point puts workerd's share at more than a tenth of the traffic crossing Cloudflare's network.²³

We covered Cloudflare's agent runtime bet last week as an infrastructure story. This is the security counterweight to it: the sandbox protects the engine, not the glue holding it together. Once a model writes the code, that glue is the boundary.

This is a pattern, not an incident

Check Point is not the only team to have reached this conclusion, and the corroboration comes from an unlikely source.

Microsoft's own security team published When prompts become shells: RCE vulnerabilities in AI agent frameworks on May 7, 2026, covering two Semantic Kernel flaws: CVE-2026-25592 in the .NET SDK and CVE-2026-26030 in the Python SDK, patched in 1.71.0 and 1.39.4 respectively.⁸⁹

In CVE-2026-26030, InMemoryVectorStore translated a user-supplied filter expression into a Python lambda without restriction — a search query became os.system.⁹

Microsoft's own guidance at the time told readers to expect analogous flaws in other frameworks.⁸ Three months later, Check Point found them.

The through-line across every case in this post is the same: a classic bug class lands in a component that holds elevated trust, and the blast radius scales with the agent's permissions rather than the bug's CVSS score.

"If one was an outlier, this would be a story about that one vendor," Tal said. "Our finding is that the same bug classes turn up in all of them."¹

What to do this week

The remediation list is unglamorous, which is the point.

Patch the named components. LangGraph users on the SQLite checkpointer need langgraph-checkpoint-sqlite 3.0.1+; the msgpack fix is in langgraph 1.0.10+.⁶ Langflow needs 1.10.1 or later — and redeploy containers from a fresh image rather than patching in place, since old builds silently persist vulnerable code.⁴

Stop exposing framework control planes. Check Point notes that self-hosted LangGraph ships without built-in authentication, and reports the same of the ADK development API. Put a reverse proxy or gateway in front of anything an agent framework listens on, and treat it as internal-only.¹⁷

Rotate anything a compromised host touched. If an internet-facing Langflow instance ran an affected version, assume its stored provider keys and connector tokens are exposed.⁴

Treat the agent runtime as a privileged identity. A compromised agent host is not one bad session — it is every credential the agent holds and every conversation it has processed.⁷ This is the same conclusion the containment incident disclosures reached from the opposite direction.

Audit for chains, not bugs. Two LangGraph findings, neither scored above 7.3, chained into remote code execution.⁶ Scanners rate components; attackers compose them.

Inventory what you actually run. Snyk's research found security teams typically see only about a third of their organisation's real AI footprint — a gap we broke down separately. You cannot patch a framework you did not know was in production.

The bottom line

The interesting thing about Black Hat 2026's agent security track is how boring the bugs were.

No novel attack primitive. No model jailbreak. Deserialization, injection, path traversal and use-after-free — moved into a layer that holds API keys, reads inboxes and writes to databases, and that the industry has been shipping faster than it has been auditing.

Langflow's CISA listing is the part that should set the timeline. That is not a research finding; that is a federal patch deadline that has already passed, on a framework doing exactly what LangGraph, ADK and Agent Framework do.

The frameworks are the attack surface now. Scan them like it.