Check Point finds recurring security flaws in AI agent frameworks

Security researchers at Check Point say the main risk in many AI agent systems is not prompt injection alone, but the way agent frameworks process content that an attacker can influence. Their findings, presented at Black Hat, cover 11 vulnerabilities across several widely used development platforms.

The year-long review examined LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google’s Agent Development Kit (ADK). According to the researchers, the affected products can allow untrusted text or files to cross into trusted functions responsible for orchestration, memory, routing and state management.

Yarden Porat and Shahar Tal said the vulnerabilities largely involved established security problems rather than novel AI-specific techniques. The reported categories included insecure deserialization, server-side request forgery, path traversal and use-after-free issues. Their concern is that these weaknesses now appear in software that can read business documents, access cloud credentials or modify enterprise data.

Checkpoint flaw enabled code execution

One critical issue in Microsoft Agent Framework involved checkpoint data. Checkpoints preserve an agent’s progress and conversation history so a session can later be resumed. Check Point said an attacker could use prompt-controlled content to place a malicious payload in a checkpoint, which could then be activated when another session restored that state.

Microsoft acknowledged the report, paid a $10,000 bounty and released protections intended to block the demonstrated attack path. The company also added language clarifying the security boundary for the affected checkpoint file. No CVE was assigned because the framework was not generally available when the issue was reported.

Google ADK exposure

Check Point also reported a weakness in Google ADK’s built-in development assistant. The researchers said an unauthenticated HTTP interface could be used to create and run an agent containing Python code that executes during import. In a default Cloud Run deployment, they alleged, the resulting process could access environment keys and the container’s Google Cloud service account.

Google initially disputed the classification of the issue, according to Check Point, but later paid a $3,133.70 bounty and applied a partial fix. The researchers said their total rewards came to $17,133.70.

Check Point’s broader conclusion is that organizations should assume prompt injection attempts will occur and focus on ensuring that injected content remains untrusted data rather than influencing framework control logic.