Since the arrival of mainstream chatbots, the AI security conversation has centered on prompt injection, the trick of slipping instructions into content that a model later reads. Two Check Point researchers argue the industry has been staring at the wrong layer. In a year-long study presented at Black Hat USA on August 5, Yarden Porat and Shahar Tal disclosed 11 vulnerabilities in the frameworks that enterprises use to wire AI agents into their systems, and their central finding is that the frameworks themselves, not the models inside them, are where the damage happens.
The affected software covers most of the popular agent tooling: LangChain and its graph sibling LangGraph, CrewAI, AutoGen, Microsoft’s Agent Framework, Google’s Agent Development Kit, and Semantic Kernel. The researchers found exploitable logic in the components that make agents agents, namely memory stores, planning loops, serialization layers, and orchestration logic. In several cases, attacker-controlled content was able to cross the boundary from the data plane into trusted framework logic, influencing how the agent manages its state, routes work, and applies system instructions.
The most striking aspect of the research is how little of it was novel. The vulnerabilities were old, well-understood bug classes: insecure deserialization, server-side request forgery, path traversal, and use-after-free. They are the kinds of flaws the industry learned to fix two decades ago, now sitting underneath systems that read inboxes and update databases. Because the attacks operate inside framework internals, an agent does not need dangerous tools for an attacker to profit; in one scenario described by the researchers, a single hostile document encountered by an agent was enough to compromise it.
Two case studies illustrate the pattern. In Microsoft’s Agent Framework, the researchers found a critical deserialization flaw in agent checkpoints, the serialized snapshots that record an agent’s state and task progress. Microsoft paid a $10,000 bounty and patched the flaw; no CVE was assigned because the framework was not yet generally available. In the attack they demonstrated, a payload planted in one person’s message fired when a different user rewound their own session, giving the attacker a shell on the server.
Google’s Agent Development Kit produced a messier outcome. A built-in development assistant that can write files remained reachable over the kit’s HTTP API even though it was hidden from the application listing, and the API carries no authentication by default. Deploying with the kit’s cloud command exposes the identical API, meaning a standard Cloud Run deployment can be reached without credentials, handing an attacker the runtime environment’s API keys and its cloud service account. Google initially classified the issue as not a bug; it later paid $3,133.70 and shipped only a partial fix, again without a CVE.
Across all of the disclosures, the researchers collected $17,133.70 in bounties. They were at pains to note that no single vendor was the outlier: the same bug classes appeared across every framework, which points to a systemic problem rather than a fixable vendor defect. Roughly a third of the Black Hat program this year was devoted to AI security, a sign that the agent stack has become a primary attack surface. The practical advice for defenders is to plan for prompt injection as a certainty and to architect agents so that prompt-controlled content stays quarantined from the trusted logic that manages state, routing, and orchestration, rather than trying to eliminate injection entirely.
Sources: Prompt injection isn’t the bug, AI agent frameworks are (The Register, Aug 5, 2026); Black Hat Day 1 Briefings Reveal the Agent Stack Is the Attack Surface (Forkast, Aug 5, 2026); Black Hat USA 2026, No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks (Black Hat Events, Aug 5, 2026)