"Our research shows a deeper failure: in many agentic frameworks, prompt-controlled content can cross the boundary into trusted framework logic itself," Yarden Porat and Shahar Tal warned after a year of testing major agent frameworks. Their finding, disclosed at a Black Hat presentation and reported by The Register, reframes an urgent security debate: the immediate risk is not only prompt injection of models, but what agent frameworks do with attacker-controlled content once they ingest it.
Check Point's year-long audit and the 11 disclosed vulnerabilities
Researchers from Check Point spent a year probing frameworks enterprises use to build agentic applications — including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK — and found 11 vulnerabilities they disclosed to vendors. The team told The Register almost none of the issues represented novel bug classes; instead, they were familiar flaws such as insecure deserialization, server-side request forgery, path traversal and use-after-free. “These are bugs that we learned to fix 20 years ago, and they're sitting underneath agents that now read your inbox, or update your database,” Shahar Tal said.
Microsoft Agent Framework: checkpoint deserialization leading to remote code execution
Check Point identified a critical insecure deserialization bug in Microsoft Agent Framework tied to agent checkpoints — serialized snapshots of agent state used to rewind sessions. Via prompt injection, an attacker could plant malicious checkpoint data; when a different user rewound their session to that checkpoint, the system could deserialize the payload and execute code, giving the attacker shell access to the server. Microsoft acknowledged the report, paid a $10,000 bug bounty and implemented protections to harden the Agent Framework and the checkpoint file semantics. Because the framework was not a generally available product when the vulnerability was found, Microsoft did not assign a CVE, a company spokesperson told The Register.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleGoogle ADK: an API, import-time Python code and partial remediation
Check Point also detailed an exploitation path in Google ADK that hinged on a built-in development assistant capable of writing files and remaining reachable over an HTTP API even where the assistant was hidden from app listings. The researchers said an attacker could open a session, instruct ADK to write an agent whose Python code executes on import, and then ask the server to run that agent. Because the server would import the file, the attacker's code would run. According to Check Point, the API has no authentication by default and adk deploy cloud_run publishes the same API, leaving a default Cloud Run deployment reachable without credentials. From there, the researchers said, the executed code could reach environment API keys and the container's Google Cloud service account.
Google initially did not classify the issue as a bug, the researchers said; Check Point argued the consequence — code execution that accesses API keys and service account credentials — constitutes “secret theft, not a developer inconvenience,” Yarden Porat told The Register. Google later issued a partial fix and paid a $3,133.70 bounty, per the researchers. Check Point’s total bounty rewards for the engagement amounted to $17,133.70.
How common low-level bugs turn into agentic high-risk paths
Tal emphasized that the model itself is not invariably the weak link: “The failure exists in the plumbing around the model, and we think this has been overlooked.” In the cases Check Point examined, attacker-controlled content moved out of the data plane and influenced trusted parts of the framework — orchestration, memory, state, routing and system instructions. The consequence: simple actions, including “reading the wrong document,” can become vectors for privilege escalation or secret exfiltration without invoking specialized tools. “The agent needs no dangerous tools to be turned against you: reading the wrong document is enough. We’re building this layer faster than we know how to defend it,” Tal said.
What this means for technologists, enterprises, and platform operators
- Technologists and security teams: Treat prompt injection as a baseline assumption and focus on hard boundaries in framework logic — for example, authenticate and isolate checkpoint data, and avoid importing untrusted code at runtime. The researchers' examples show that familiar mitigations for deserialization and file-import risks remain relevant.
- Enterprises and procurement leaders: Ask vendors for explicit documentation of security boundaries in agent frameworks, and require proof of hardened default configurations (such as authenticated APIs and safe checkpoint handling) before deployment. Check Point’s results came from widely used frameworks, underscoring supply-chain reach.
- Cloud platform operators and framework maintainers (Microsoft, Google, open-source projects): The response actions differed — Microsoft paid $10,000 and applied hardening, while Google initially dismissed the report before issuing a partial fix and a $3,133.70 bounty — illustrating that remediation and threat interpretation vary. Frameworks that publish developer-facing APIs and tools need default-deny settings and clearer security boundary language.
The Check Point findings are straightforward: agent frameworks aggregate long-known software-security pitfalls into a new, higher-impact context. The researchers presented their work at Black Hat and have made vendors confront how serialized state, import-time code execution and unauthenticated APIs can convert ordinary prompt content into a lever against infrastructure. Their closing note remains a practical challenge: defenders should assume prompt injection, and focus not only on model outputs but on the trusted plumbing that acts upon them. “A bug in an agent framework isn't a bug in one product - it's a bug in the layer a whole category of AI apps runs on,” Tal said — a layer, the researchers warn, being built faster than it is being defended.
