LAS VEGAS — The fastest way to compromise an AI agent may have nothing to do with outsmarting its model.
Researchers at Check Point examining the frameworks developers use to build AI agents found a host of flaws, including critical bugs, that could have allowed attackers to steal credentials and data from servers hosting AI agent applications.
In many cases, the frameworks lacked basic safeguards, opening the door to attacks defenders learned to mitigate a decade ago. One bug class involved a PDF parsing flaw that allowed a malicious payload to execute on the system running the agent.
Impacted frameworks included LangChain, Microsoft Agent Framework, CrewAI and Google’s Agent Development Kit, according to Check Point researchers Shahar Tal and Yarden Porat, who presented their work Wednesday at Black Hat in a session titled “No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks.”
In all, Check Point researchers Shahar Tal, head of agentic security innovation, and Yarden Porat, a security researcher, uncovered 21 findings across eight codebases, including 12 CVEs. The bugs covered decidedly old-school territory: unsafe deserialization, server-side request forgery, SQL injection, sandbox escapes, arbitrary file reads, memory corruption and shared-state flaws.
That was part of what surprised the researchers. For all the attention being paid to exotic AI threats such as prompt injection and jailbreaks, many of the weaknesses they found belonged to vulnerability classes defenders have been dealing with for years.
“We’re still building it like it’s 10 years ago, and it’s not 10 years ago,” Tal said.
The problem, he said, is that agent frameworks are being pushed rapidly into enterprise environments without some of the hardened defenses that have accumulated around mature software over decades.
“These frameworks are not yet developed enough [to] have the correct mitigations in place, have battle-tested mitigation,” Tal said. “It’s taken us like a decade or even 15 years to get browsers to that point.”
Hundreds of Millions of Downloads Widen the Blast Radius
While all vulnerabilities have been patched or mitigated, the potential downstream impact was enormous. LangChain alone recorded more than 300 million PyPI downloads over the past month, while Google’s ADK and CrewAI collectively added tens of millions more. One caveat: downloads don’t always equal the number of AI agents built.
Where the framework sits
The code layer between the model’s decisions and the machine it runs on.
Normal operationHowever, developers seldom use the frameworks for one person on one laptop. Companies use them to build agents that sit between employees and corporate data, cloud services, databases, source-code repositories and other business applications.
In one example described by Tal, a business could build an internal document-analysis agent using one of the vulnerable frameworks. It runs on a server in its data center or cloud environment. An attacker doesn’t need to breach that network first to reach sensitive data hosted by the company. Exploiting the bug simply requires an agent to process a malicious document, which triggers code execution on the computer or server where the agent was running.
From there, the compromise is no longer confined to the employee who submitted the document.
“We can do anything the agent can do,” Tal said. That could include reading information previously sent to the agent, accessing files available to the agent process, stealing credentials and tokens, invoking connected tools and potentially using those privileges to move deeper into the environment.
“It could be on the cloud. It could be in your data center. It could be anywhere these frameworks are deployed,” Tal said.
Exploiting one vulnerable LangChain or CrewAI application would not automatically compromise every other agent built with that framework. Rather, the blast radius would include immediate network ecosystem and every downstream application that incorporates the tainted AI agent.
An agent restricted to summarizing public documents presents one level of risk, researchers said. An enterprise agent with access to Salesforce, Microsoft 365, GitHub, internal databases, cloud APIs or proprietary documents presents another. Compromise the latter and the attacker effectively inherits the agent’s permissions, Tal told Security Point Break.
Breaking Down the Bugs
Of the 12 CVEs, four were rated critical, six high and two medium.
One of the most serious flaws, dubbed LangGrinch, affected langchain-core and could let an attacker turn data processed by an AI agent into a path for stealing secrets from the system running it. LangGrinch had been disclosed previously, but Black Hat marked the first time Check Point presented the findings together as part of its broader audit of AI agent frameworks, along with several previously undisclosed flaws.
The researchers showed how an attacker could abuse LangChain’s deserialization process to reach stored API keys, cloud credentials and other secrets.
Tracked as CVE-2025-68664 and rated critical (9.3) the bug could also be abused to enable server-side request forgery and, in some configurations, remote code execution.
A similar deserialization vulnerability was found by Check Point in Microsoft Agent Framework’s checkpoint system. Checkpoints preserve an agent’s state as it moves through a workflow.
The vulnerable deserializer accepted a class marker, resolved its module and class name, and instantiated it using attacker-controlled arguments. In the researchers’ demonstration, those arguments were converted into shell-command execution.
While Check Point Microsoft paid a $10,000 bounty for the discovery through its bug bounty program, the issue did not receive a CVE because it was reported before the framework reached general availability.
Beyond LangGrinch: RAG, Sandboxes and Agent State
More conventional weaknesses also appeared in other agent stacks.
In CrewAI, flaws in its retrieval-augmented generation pipeline allowed attacker-controlled files and URLs to reach places they should not. One critical SSRF vulnerability could make the server request internal resources, while another flaw allowed arbitrary files to be read from disk. Two additional critical bugs affected CrewAI’s execution environment, including an insecure sandbox fallback and a Code Interpreter sandbox escape that could lead to remote code execution.
Check Point also found memory-corruption flaws in two underlying document-processing libraries used by agent frameworks. One affected MuPDF, an open-source library for parsing and rendering PDFs and other document formats, which CrewAI invokes when processing PDFs. Another affected the Pillow imaging library used through Microsoft AutoGen. In Check Point’s CrewAI demonstration, simply feeding the agent a malicious PDF was enough to crash the Python process.
Companies do not need to stop using agents built with the affected frameworks, but older deployments may still be running vulnerable versions. But older agents may still be running vulnerable versions. Organizations should check which framework versions their agents use and update any outdated components.
The research challenges the increasingly familiar assumption that securing an agent is primarily about stopping jailbreaks, prompt injection or abusive tool calls.
“Everyone watches the model and the tools,” Tal told Security Point Break . “The bugs are underneath.”
Where is the Risk?
Tal and Porat stressed that the affected frameworks are not finished AI products such as ChatGPT, Claude or Microsoft Copilot. They are software building blocks developers use to create their own agents — often specialized applications inside companies that connect an LLM to corporate documents, databases, APIs, software tools, memory and MCP servers.
A company might use one to build an internal agent that reviews contracts, searches company records, processes invoices or updates business systems. The framework sits underneath that agent, handling how the model talks to those resources and what actions it is allowed to take.
A December 2025 enterprise survey by Zapier found 46% of organizations use orchestration frameworks to build agents, underscoring how often enterprise AI is assembled from third-party building blocks rather than coded from scratch. Only 26% said they build agents entirely in-house.
Researchers advise security practitioners to update affected frameworks and dependencies, validate RAG inputs, sandbox document parsers and code interpreters, restrict deserialization and limit the credentials agents can access.
The larger lesson, Tal said, is untrusted content does not become safe because an LLM accepted it.
“We are trusting agents with a lot these days,” he said. Guardrails must judge not just what an agent is doing, but who triggered it, why and whether the behavior is normal.
“You don’t need a new threat model. You need an old one, pointed somewhere new,” he said.
