Check Point researchers find 11 vulnerabilities in major AI agent frameworks

Security researchers from Check Point have uncovered 11 vulnerabilities across nearly a dozen prominent AI agent frameworks, signaling a systemic failure in how these tools handle untrusted content. The findings, presented at Black Hat by Yarden Porat and Shahar Tal, suggest that the primary risk to AI systems is not the act of prompt injection itself, but the failure of the surrounding infrastructure to prevent that injected content from crossing into trusted logic.

The vulnerabilities span a wide array of industry-standard tools, including LangChain, LangGraph, CrewAI, AutoGen, the Microsoft Agent Framework, and Google ADK. Among the most severe discoveries was a critical insecure deserialization bug in the Microsoft Agent Framework, which researchers found could allow for remote code execution (RCE) via prompt injection into agent checkpoints. Similarly, a flaw in Google ADK enabled attackers to leverage a built-in development assistant to write and execute Python code, a path that could potentially expose Google Cloud service accounts and API keys. For their work, Porat and Tal received $17,133.70 in bug bounties, including $10,000 from Microsoft and $3,133.70 from Google.

The return of legacy bugs

While the AI industry has largely focused on preventing prompt injection at the model level, this research highlights a dangerous gap in the "plumbing"—the orchestration, memory, and routing layers that allow agents to function. The researchers noted that these frameworks are being developed at a pace that far exceeds their security defenses. Consequently, modern AI tools are re-introducing classic software vulnerabilities, such as server-side request forgery (SSRF) and insecure deserialization, which were largely solved decades ago.

Shahar Tal emphasized the gravity of this regression, stating, "These are bugs that we learned to fix 20 years ago, and they're sitting underneath agents that now read your inbox, or update your database."

Systemic industry risk

This shift in perspective moves the security conversation away from the behavior of the Large Language Model (LLM) and toward the infrastructure supporting it. Because these frameworks serve as the foundational layer for a vast category of enterprise AI applications, a single vulnerability in the framework can compromise every application built upon it. This creates a massive attack surface where a single flaw could grant an adversary shell access to corporate servers or the ability to steal sensitive cloud credentials.

As Tal put it, "A bug in an agent framework isn't a bug in one product - it's a bug in the layer a whole category of AI apps runs on."

What to watch

The discovery of these flaws underscores the need for a more rigorous security audit of the orchestration layer in AI development. As enterprises continue to deploy agents with high-level permissions to interact with internal databases and emails, the pressure is on framework maintainers to implement stricter boundaries between LLM outputs and system execution. The industry must now determine if these 11 vulnerabilities are isolated incidents or symptomatic of a broader, unpatched architectural weakness across the entire AI agent ecosystem.