Check Point Discloses 11 Vulnerabilities Across Six Enterprise AI Agent Frameworks

LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK

Yarden Porat and Shahar Tal of Check Point presented 11 vulnerabilities found in the framework layer beneath agentic applications, disclosed at Black Hat USA 2026. The bug classes were conventional: insecure deserialization, server-side request forgery, path traversal, and use-after-free. In the Microsoft Agent Framework, a checkpoint deserialization flaw allowed an attacker to plant a payload through prompt injection in one message and have it execute when another user rewound their session; Microsoft paid a $10,000 bounty and patched it, with no CVE issued because the framework was not yet generally available. In Google ADK, a development assistant capable of writing files remained reachable over an HTTP API by default despite being hidden from the app listing and protected by no authentication, so an attacker could request code generation at import time and have it execute when the server imported the malicious agent file; Google paid $3,133.70 and issued a partial fix. Total bounties across the research came to $17,133.70

Attacker-controlled prompt content crosses from the data plane into trusted logic, memory, routing, and state handling, which makes prompt injection the delivery mechanism and the middleware the actual vulnerability. As Tal framed it, "A bug in an agent framework isn't a bug in one product, it's a bug in the layer a whole category of AI apps runs on"