Full Report
Check Point researchers tried to break the frameworks enterprises use to build AI apps. Now they're telling Black Hat attendees what they found
Analysis Summary
# Vulnerability: Post-Injection Exploitation in AI Agent Frameworks
## CVE Details
- **CVE ID**: N/A (Vendors declined to issue CVEs as products were in pre-GA/development states)
- **CVSS Score**: Estimated 9.8 (Critical) for RCE flaws
- **CWE**:
- CWE-502: Deserialization of Untrusted Data
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
- CWE-918: Server-Side Request Forgery (SSRF)
- CWE-416: Use After Free
## Affected Systems
- **Products**:
- Microsoft Agent Framework
- Google ADK (Agent Development Kit)
- LangChain / LangGraph
- CrewAI
- AutoGen
- **Versions**: Specific versions at the time of the August 2026 Black Hat presentation (Contact vendors for latest hardened versions).
- **Configurations**:
- Systems using "Checkpoints" for state persistence.
- Google ADK deployed via `adk deploy cloud_run` (default settings).
- Frameworks where agents possess "tools" to read documents or sync with databases.
## Vulnerability Description
Research by Check Point reveals a systemic failure in AI orchestration layers where prompt-controlled content (untrusted data plane) crosses into the framework logic (trusted control plane).
- **Microsoft Agent Framework:** Insecure deserialization within the "checkpoint" mechanism. Checkpoints save agent states (task progress, history) to persistent storage. An attacker can use prompt injection to plant a malicious payload in the checkpoint data. When a user or system "rewinds" or reloads that session, the framework deserializes the payload, leading to Remote Code Execution (RCE).
- **Google ADK:** The framework includes a hidden development assistant reachable via HTTP API without default authentication. An attacker can instruct ADK to write an agent with Python code that executes at import time. By calling the API to run that agent, the server imports the file and executes the attacker's arbitrary code.
## Exploitation
- **Status**: PoC available (demonstrated by Check Point researchers at Black Hat).
- **Complexity**: Low to Medium (Utilizes "old" bug classes triggered via prompt injection).
- **Attack Vector**: Network (often via document ingestion or direct interaction with the agent).
## Impact
- **Confidentiality**: Total (Access to environment API keys, service accounts, and databases).
- **Integrity**: Total (Ability to execute arbitrary code and modify system state).
- **Availability**: Total (Potential for full system takeover or service disruption).
## Remediation
### Patches
- **Microsoft:** Released hardening updates and updated checkpoint encoding logic. Users should update to the latest version of the [Microsoft Agent Framework](https[://]github[.]com/microsoft/agent-framework).
- **Google:** Issued a partial fix and mitigation for ADK.
- **General:** Ensure all AI orchestration libraries (LangChain, CrewAI, etc.) are updated to versions released post-August 2026.
### Workarounds
- **Authentication:** Enforce strict authentication on all internal APIs used by agent frameworks, especially for deployment tools.
- **Sandboxing:** Run AI agents in heavily sandboxed environments (e.g., gVisor, firecracker) with minimal filesystem access.
- **Input Validation:** Treat all outputs from LLMs as untrusted "data" and prevent them from reaching "eval()" or deserialization functions.
## Detection
- **Indicators of Compromise**:
- Unexpected Python import-time executions.
- Unauthorized calls to `adk deploy` or checkpoint reload APIs.
- Outbound connections from AI agent containers to internal metadata services (attempted SSRF).
- **Detection Methods**:
- Monitor filesystem integrity for unauthorized `.py` or serialized state files.
- Audit logs for "rewind" or "checkpoint" operations triggered by external prompts.
## References
- **Vendor Hardening**: [github[.]com/microsoft/agent-framework/blob/main/python/packages/core/agent_framework/_workflows/_checkpoint_encoding.py]
- **Research Source**: Check Point Research Black Hat 2026 Presentation.
- **News Coverage**: [The Register - Prompt injection isn't the bug, AI agent frameworks are](https[://]www[.]theregister[.]com/2026/08/05/ai_agent_frameworks_vulnerabilities/)