The total bounty for 11 critical vulnerabilities across six major AI agent frameworks? $17,133.70. That is less than the cost of a single DeFi protocol audit. Microsoft's Remote Code Execution — $10,000. Google's unauthenticated API exposing cloud credentials — $3,133.70. The rest: pocket change.
The code compiles, but the reality bankrupts.
At Black Hat USA 2026, Check Point Research disclosed a systematic sweep of vulnerabilities in six AI agent frameworks: LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. Every single one had exploitable flaws. The attack chains are not exotic — they are return-to-sender forms of decades-old software security debt: deserialization, SQL injection, Server-Side Request Forgery, path traversal, use-after-free. The industry is busy debating alignment and jailbreaks, while the infrastructure layer is wide open.
This is not a freak accident. It is the predictable outcome of building new technology on old assumptions. As a due diligence analyst who has audited over fifty DeFi protocols, I recognize the pattern: the hype cycle outruns the security baseline. The same mistake that gave us the DAO hack, the Parity wallet freeze, and the Terra collapse is now being replicated in AI agent frameworks. The asset class changes, but the math does not.
Let me walk through the mechanics. The core vulnerability is not in the LLM. It is in the framework's state management layer — the checkpoint system. Every agent framework needs to persist agent state: conversation history, tool call results, partial execution. The common approach is to serialize this state — often via Python's pickle, MessagePack, or YAML — and store it in a database (SQLite, Redis) or a file.
The attack chain is remarkably consistent across all six frameworks:
- Prompt injection: Attacker injects a malicious payload into a prompt that gets processed by the agent.
- Payload ends up in the checkpoint: The agent's state includes the attacker-controlled content.
- Another user or session loads the checkpoint: The framework deserializes the state without validation.
- Deserialization triggers RCE: The malicious payload executes arbitrary code in the context of the application.
LangGraph had three CVEs — all in the persistence layer. get_state_history() suffers from SQLite injection. Checkpoint loading uses MessagePack deserialization without sanitization, enabling RCE. The checkpointer integrates with Redis without proper query parameterization, exposing injection paths. These are not advanced exploitation techniques. They are the same flaws that have plagued web applications for two decades, now wrapped in an AI agent's shiny packaging.
Google ADK's vulnerability is even more pedestrian. The framework includes a hidden development assistant that listens on a HTTP API — no authentication. The command adk deploy cloud_run defaults to deploying this API to the public internet. No authentication. The result: anyone can access the API, which in turn can read environment variables containing GCP service account credentials and API keys. The path from "deploy" to "compromised cloud account" is a straight line. This is equivalent to deploying a debug endpoint to production — a mistake that would fail any basic security review in a traditional software project.
Microsoft Agent Framework's flaw is the most elegant in its simplicity. The session rewind feature allows any user to load a prior checkpoint. If an attacker injects a malicious checkpoint, a subsequent user who loads that session triggers the deserialization. The attacker gains a shell. The framework trusts the user's input because it assumes the model will filter it. But the model is not the problem — the framework is.
I have seen this before. In 2017, I audited an ICO vesting contract. The integer overflow was in the Solidity code, not the tokenomics. The developer assumed that the input would always be within a safe range. The same assumption: "the user will not send malicious data." The agent framework assumes the LLM will sanitize output. But the LLM is not a security boundary. It is a content generator. The framework must enforce its own boundaries.
The scale of the problem is systemic. Six frameworks, all vulnerable. The root cause is not a single line of code — it is the absence of a threat model that treats the agent's state as untrusted input. This is the same oversight that led to reentrancy in Ethereum smart contracts: the assumption that external calls are safe. In DeFi, the audit community learned to treat every call as a potential attack vector. In AI, the agent community has not yet learned that every checkpoint is a potential exploit.
Contrarian: The bulls will tell you that these vulnerabilities require specific conditions: multi-user checkpoint sharing, exposed APIs, or a willing accomplice. They will argue that the threat model is narrow and that the fixes are trivial. They are partially right. The exploitation path is not zero-click. The vulnerabilities are not yet widely publicized. The frameworks are still in early adoption.
But they miss the point. The real blind spot is not the specific bugs — it is the industry's focus on model-level security while ignoring the infrastructure layer. The alignment debate, the jailbreak arms race, the guardrails — all of that is downstream of the fundamental question: "How do you secure the pipeline that connects the model to the external world?" The answer is not yet designed. The frameworks are being built on top of runtime environments that were never designed for this level of trust.
The contrarian angle: This disclosure is actually a gift. It happens before wide-scale adoption. It forces the industry to address the security debt early. The LangGraph team responded with CVE assignments and patches. Microsoft fixed the issues before GA. Google's response was less clean — initial denial, then partial fix — but the vulnerability is documented. The market can now differentiate based on security posture.
However, the $17k bounty reveals a deeper problem. The market does not yet value security in agent frameworks. The cost of a single RCE in a cloud environment is orders of magnitude higher than the bounty. In DeFi, we learned that the cost of a hack is not just the stolen funds — it is the loss of trust, the regulatory scrutiny, the collapse of the token price. The same economics apply to AI agents. The bounty is a signal of mispricing.
I spent two months dissecting the Terra/Luna seigniorage model. The math was impossible from the start. The same is true here: the assumption that a checkpoint can be safely loaded without validation is mathematically unsound. The proof is in the exploit. The industry is building on a foundation of sand, and the tide is coming in.
The next major security crisis in AI will not be a model jailbreak. It will be a remote code execution through an agent framework. The $17,133.70 bounty is a market signal that the industry is underinvesting in security by at least two orders of magnitude. The frameworks that survive will be the ones that treat their state management as a security-critical component — not a feature to be rushed.
I do not trust the audit; I trust the exploit. The exploit is here. The question is whether the industry will learn from DeFi's mistakes or repeat them with a new coat of AI paint. The transaction is permanent; the mistake is not.