Prompt injection isn't the bug, AI agent frameworks are

Check Point researchers have uncovered critical flaws in major AI agent frameworks used by enterprises, revealing a security failure that extends beyond prompt injection or a single model. These vulnerabilities could allow attackers to cross into trusted framework logic and potentially execute malicious code. Yarden Porat and Shahar Tal from Check Point found 11 such vulnerabilities while testing popular frameworks like LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK.

The team emphasized that these issues are not unique to individual products, but rather stem from weaknesses in the underlying framework layer. The researchers explained that these bugs include insecure deserialization, server-side request forgeries, path traversals, and use-after-free – issues that have been known for decades. They argue that these vulnerabilities exist in the "plumbing around the model," meaning they reside in the framework's infrastructure rather than the AI model itself.

The researchers stressed that defenders should treat prompt injection as a given, as the true vulnerability lies in how frameworks handle injected content. For instance, they discovered a critical checkpoint deserialization bug in Microsoft Agent Framework that led to remote code execution. In this case, an attacker could prompt the agent to load untrusted checkpoint data, allowing them to execute malicious code on the system.

Microsoft acknowledged the issue, paid a $10,000 bug bounty, and fixed the vulnerability without issuing a CVE due to the framework's status at the time. Similarly, Google's ADK was found to have flaws, although the company initially dismissed the issue as a "code execution" rather than a bug, and only offered a partial fix without issuing a CVE.

The researchers concluded that the failure exists in the framework's infrastructure, and the same bug classes are prevalent across all examined frameworks.