Black Hat 2026: Old-School Bugs Crack Agent Frameworks

On August 7, 2026, Check Point researchers presented an audit of LangChain, CrewAI, Microsoft Agent Framework and Google ADK at Black Hat: 21 findings across 8 codebases, 12 of them assigned CVEs. The bugs were unglamorous—unsafe deserialization, server-side request forgery, SQL injection, sandbox escapes, arbitrary file reads, memory corruption, shared-state flaws. The takeaway was blunt: attackers do not need to beat the model. They can crack the plumbing beneath it.

Attackers Don't Beat the Model—They Crack the Plumbing

These frameworks are not finished AI products like ChatGPT, Claude or Copilot. They are software building blocks developers use to build their own agents—often specialized applications inside companies that connect an LLM to corporate documents, databases, APIs, software tools, memory and MCP servers. The framework sits underneath the agent, handling how the model talks to those resources and what actions it may take. A December 2025 Zapier survey found 46% of organizations use orchestration frameworks to build agents; only 26% build entirely in-house.

That makes the blast radius enormous. An enterprise agent configured to reach Salesforce, Microsoft 365, GitHub, internal databases or cloud APIs, once its framework is compromised, hands the attacker all of its permissions. Researchers showed that an attacker does not even need to breach the corporate network first—having the agent process a single malicious document can trigger code execution on the server running it, reading information previously sent to the agent, accessing files available to its process, stealing credentials and tokens, invoking connected tools, and pivoting deeper into the environment.

Anatomy of 12 CVEs: From LangGrinch to Sandbox Escapes

One of the most serious flaws, dubbed LangGrinch, affects langchain-core (CVE-2025-68664, critical, rated 9.3). An attacker can abuse LangChain's deserialization process to reach stored API keys, cloud credentials and other secrets, and in some configurations enable SSRF or remote code execution. LangChain alone recorded more than 300 million PyPI downloads over the past month, with Google's ADK and CrewAI collectively adding tens of millions more.

Microsoft Agent Framework presented a similar deserialization flaw in its checkpoint system, which preserves an agent's state across a workflow. Its vulnerable deserializer accepted a class marker, resolved its module and class name, and instantiated it with attacker-controlled arguments—which the researchers turned into shell-command execution. CrewAI's problems sat in its RAG pipeline: one critical SSRF could make the server request internal resources, another flaw allowed arbitrary files to be read from disk, and two additional critical bugs affected its execution environment, including an insecure sandbox fallback and a Code Interpreter sandbox escape leading to remote code execution.

Beyond the frameworks themselves, researchers found memory-corruption flaws in two underlying document-processing libraries: MuPDF, which CrewAI invokes when processing PDFs, and the Pillow imaging library used through Microsoft AutoGen. In their CrewAI demonstration, simply feeding the agent a malicious PDF was enough to crash the Python process.

Why Agent Frameworks Aren't Ready

Check Point's head of agentic security innovation stressed that these frameworks are being pushed rapidly into enterprise environments without the hardened defenses that have accumulated around mature software over decades. "These frameworks are not yet developed enough to have the correct mitigations in place, to have battle-tested mitigation." It took a decade or fifteen years to get browsers to that point—agent frameworks are nowhere near.

Companies do not need to stop using agents built on these frameworks. The risk is in older deployments still running vulnerable versions. Organizations should check which framework versions their agents use and update any outdated components. Exploiting one vulnerable LangChain or CrewAI application would not automatically compromise every other agent built with that framework—but the blast radius covers the immediate network ecosystem and every downstream application that incorporates the tainted agent.

OOMeta's View

The Black Hat 2026 disclosures deliver a sobering judgment: the weak link in agent security is not the model but the framework and runtime. Battling "new" threats like prompt injection and jailbreaks matters, but what gets exploited at scale is often the old playbook—deserialization, SSRF, sandbox escapes—aimed at a new target. For enterprises this shifts the security center of gravity from "making the model behave" to "making the framework and runtime hold the line": add agent frameworks to dependency inventories, scan for vulnerabilities, sandbox parsers, limit credentials. Traditional AppSec discipline is now the entry ticket to agent security.

References: Security Point Break, "Black Hat 2026: AI Agent Framework Flaws Expose Secrets", 2026-08-07, https://securitypointbreak.com/2026/08/07/black-hat-2026-old-school-bugs-crack-open-ai-agent-frameworks/ · Check Point Research, "When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers", 2026-08, https://research.checkpoint.com/2026/when-agentic-glue-melts/