Prompt injection isn't the bug, AI agent frameworks are

A group of researchers from Check Point have discovered a series of critical vulnerabilities in major AI agent frameworks used by enterprises to build applications. These issues, which include insecure deserialization, server-side request forgeries, path traversals, and use-after-free, extend beyond prompt injection and affect the underlying framework logic.

The researchers spent a year attempting to exploit various frameworks, such as LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK, and found 11 vulnerabilities in total. Although these are old threats, the problem lies in the "plumbing around the model," as researchers Yarden Porat and Shahar Tal explain.

They argue that defenders should assume prompt injection will occur, as many AI frameworks fail to properly secure injected content. A critical example is the Check Point team discovering a critical checkpoint deserialization bug in Microsoft Agent Framework which allows remote code execution. Other vulnerabilities found, such as those in Google ADK, resulted in partial fixes and no CVE issuance.

Overall, the researchers highlight the need for better framework security, as the vulnerabilities are not limited to a single vendor or framework, but rather a systemic issue across various platforms.