Prompt Injection Is Just the Way In. The Agent Framework Is the Hole

Most of what I've read about prompt injection treats it as a model problem. The model read something it shouldn't have trusted, so it did something it shouldn't have done. The fix, in that framing, is a better model or a stricter list of tools.

A talk at Black Hat USA this week argued that framing misses where the real damage happens. I think it's the most useful security story of the summer for anyone who builds with agents.

What happened

Shahar Tal and Yarden Porat of Check Point Research presented "No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks" on Wednesday. Check Point's own recap says they audited the frameworks a lot of the industry actually builds agents on: LangChain, Google's ADK, Microsoft Agent Framework and CrewAI, and found 12 CVEs across the four.

The Register's report on the talk counts it a little differently: 11 vulnerabilities across six frameworks, adding LangGraph and AutoGen to the list. I can't tell from what's public which tally is the right one. The pattern matters more than the count.

The thesis, in Check Point's words: treating prompt injection "purely as a model behavior problem, or purely as tool misuse, misses where the real damage happens." The damage happens when attacker-controlled text crosses into the framework's own plumbing: its serialization, its caching, its file parsers. None of that code was written to handle hostile input.

How it works

The bit that stuck with me is how little the attacker has to do. In several cases, Check Point says, nobody calls a dangerous function at all. A poisoned document lands in the agent's memory, and the framework's own save-and-reload behavior fires the payload.

The Register describes two of the findings in detail:

• Microsoft Agent Framework. An insecure deserialization bug in the checkpoint feature. Injected content could get the agent to load malicious checkpoint data, which led to code execution on the server. Tal's description of the attack: one person's message plants the payload, a different person rewinds their own session, and the attacker gets a shell. Microsoft paid a $10,000 bounty and shipped fixes. There's no CVE, because the framework wasn't generally available when the bug was found.
• Google ADK. ADK ships a built-in development assistant that can write files, and it stays reachable over the HTTP API even though it's hidden from the app list. An attacker could have it write an agent whose Python runs on import, then ask the server to run it. Porat says there's no authentication on that API by default, and adk deploy cloud_run publishes the same API. Google paid a bounty and issued a partial fix.

If the checkpoint part sounds familiar, it should. Back in June, Porat published a write-up on LangGraph's checkpointer: a SQL injection in the SQLite checkpointer that could plant a forged checkpoint, plus unsafe msgpack deserialization that could turn that checkpoint into code execution. LangChain patched all three issues he reported. Same shape: state the agent saves, then trusts on the way back in.

Why it matters if you build software

Here's how I understand it. An agent framework is doing two jobs at once. It moves data around (documents, tool results, chat history) and it runs control (which step is next, what gets saved, what gets reloaded). Prompt injection is how attacker text gets into the data. These bugs are what happen when that data leaks into control.

That's not a new idea. It's the oldest lesson in web security. SQL injection is data becoming a query. Deserialization bugs are data becoming objects. Check Point's closing point was exactly that: most of these bugs are ones the security community already knows how to fix. The hard part is recognizing them "once they've moved into a new part of the stack."

I came to app development from years of .NET, and this one rang a bell. Microsoft spent years warning people off BinaryFormatter because deserializing untrusted bytes can run code, and eventually took it out of the runtime. Python's pickle carries the same warning in its docs. Agent frameworks are young enough that some of them re-learned the lesson in public.

Tal put the scale problem well: "A bug in an agent framework isn't a bug in one product." Every app built on that framework inherits it.

What I'm taking from it

A short checklist I'm applying to anything agent-shaped I build:

• Treat agent memory and checkpoints as untrusted input. Anything that was ever touched by a model's context could carry attacker text. Validate it on reload like you'd validate a request body.
• Know your serializer. If a framework persists state with pickle, msgpack extensions or anything that can construct arbitrary types, find out what it allows.
• Dev servers are not deployments. If a framework ships a dev UI or helper API, check whether your deploy command publishes it, and whether it has auth.
• Pin and patch frameworks like web frameworks. These are now part of your attack surface, not just your dependency list.

Quick hits

• OpenAI says it can't rule out "Critical" cyber capability for Astra (Aug 7). OpenAI says preliminary evaluations of its unreleased Astra model are strong enough that it can't rule out the top tier of its Preparedness Framework, and stresses this isn't a final determination. It's adding stricter controls, including isolated testing and restricted network and tool access, and plans outside testing with government agencies and safety groups. A month ago a government paused a model over the same kind of capability; this time the lab is flagging it itself.
• Cloudflare launches Kitesurf, a browser for agents (Aug 6). Part of Cloudflare's Agents Week: a stateless browser that runs on Workers, opt-in with browser=kitesurf on Browser Run endpoints and free during beta. Cloudflare says it uses roughly 3–7× less CPU and memory than Chromium for screenshots and HTML extraction, but it's slower and skips things like WebGL and video.
• Meta launches Muse Code (Aug 5). A terminal coding agent in beta, built on Muse Spark 1.2. Subagents can each get their own git worktree, and sessions are logged as JSONL so you can resume after a crash. Read the tiers carefully: the cheaper contributor tier lets Meta use your requests "to improve our products."
• EFF: Android ad SDKs leak precise location by default (Aug 4). EFF names InMobi, BidMachine, Verve's HyBid and Huawei's Petal Ads. SDKs inherit your app's location permission, so if your app has it, your ad library may be sending it into ad auctions. Check each SDK's opt-out instead of trusting the defaults.

What I'm watching

Whether Check Point publishes full technical write-ups for each framework, and whether OpenAI makes a final call on Astra.

Sources

Agent framework flaws (Black Hat)

• Check Point Research, Black Hat 2026 recap, including the agent framework talk (Aug 6, 2026)
• Check Point Research, LangGraph checkpointer write-up, SQL injection to RCE (Jun 11, 2026)
• The Register, coverage of the Black Hat talk (Aug 5, 2026)

Quick hits

• OpenAI, preliminary cyber evaluations of Astra and new safeguards (Aug 7, 2026)
• Axios, report on OpenAI slowing Astra over cyber capabilities (Aug 7, 2026)
• Cloudflare, Kitesurf changelog entry and launch post (Aug 6, 2026)
• Meta, Muse Code and Muse Spark 1.2 developer blog post (Aug 5, 2026)
• Decrypt, Muse Code launch coverage (Aug 5, 2026)
• EFF, ad libraries and location privacy (Aug 4, 2026)