Researchers expose systemic flaws in AI agent frameworks beyond prompt injection

Check Point’s security team spent twelve months probing the foundations of enterprise AI agent platforms, including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, and reported eleven distinct vulnerabilities. Most of the defects are well-known classes—such as insecure deserialization, server-side request forgery, path traversal and use-after-free—now embedded in the “plumbing” that connects AI models to applications.

Exploits demonstrated that an attacker could inject malicious payloads that survive checkpoint serialization, trigger remote code execution, or bypass authentication to run arbitrary Python code, potentially exposing API keys and cloud service accounts. Microsoft responded by paying a $10,000 bounty and updating the framework, though no CVE was issued because the product was not publicly released. Google initially dismissed the issue, later offering a $3,133.70 bounty and a partial remediation.

In total, the researchers earned $17,133.70 for their disclosures. The findings highlight that securing AI applications requires attention to the underlying frameworks, not just model-level defenses.