Check Point spent a year auditing LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK: the vulnerabilities found are classic classes of bugs, not new ones.
Presented on August 5, 2026 at Black Hat, the work of Check Point researchers Yarden Porat and Shahar Tal shifts the cursor of the debate on agent security. After a year of auditing the frameworks used in companies — LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK — they identified eleven flaws, several of which were classified as critical.
Their nature is the salient point: insecure deserialization, server-side request forgery, directory traversal, use-after-free. These are long-known classes of vulnerabilities, housed not in the model but in the infrastructure around it. In other words, the content that an attacker slips into a document, email, or message doesn't just fool the model: it reaches the orchestration, memory, state, and system instructions that are supposed to remain inaccessible to it.
Microsoft acknowledged the critical checkpoint deserialization flaw in its Agent Framework, paid a $10,000 bounty, and hardened its code, with no CVEs issued since the framework was not yet generally available. Google initially deemed the ADK issue non-critical, before releasing a partial fix and paying $3,133.70, also without a full CVE. The total bounties are $17,133.70.
Read the full article on the original source
Go to the source →