AI Agent Framework Vulnerability Risks for UK Buyers 2026

The bug isn't in the prompt — it's in the plumbing

The research, presented at a Black Hat talk this week and shared with The Register, tested six widely used agent frameworks: LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. Across a year of testing, Check Point's Yarden Porat and Shahar Tal disclosed 11 vulnerabilities, several rated critical.

Their core finding is uncomfortable for anyone who has treated prompt injection defences as the whole job. "Our research shows a deeper failure: in many agentic frameworks, prompt-controlled content can cross the boundary into trusted framework logic itself," the pair wrote. In practice, that means content an attacker plants in a document, email or chat message doesn't just fool the model — it can reach orchestration, memory, state and system instructions that were supposed to be off-limits to user input.

Old bugs, new blast radius

What makes this notable isn't novelty. Tal was blunt about the bug classes involved: insecure deserialization, server-side request forgery, path traversal, use-after-free — the kind of defects the industry has known how to fix for two decades. The difference now is what sits on top of them.

"We're building this layer faster than we know how to defend it," Tal told The Register, describing how these familiar flaws now underpin agents with access to inboxes, databases and internal tooling. Critically, the researchers note the agent doesn't need dangerous tools connected to be exploited — reading the wrong document can be enough to trigger a chain reaction inside the framework itself.

Microsoft and Google: two very different responses

The most striking example is a critical checkpoint deserialization flaw in Microsoft Agent Framework that led to remote code execution. Agents save checkpoints — snapshots of state used to resume work after a failure — and Check Point found that untrusted checkpoint data loaded via prompt injection could let an attacker plant a payload that fires when a completely different user later rewinds their own session, handing the attacker a shell on the server.

Microsoft paid a $10,000 bounty, fixed the issue and hardened the framework, telling The Register it had updated the checkpoint file "to define the security boundary." No CVE was issued, because the framework wasn't yet generally available when the flaw was reported.

Google's response to flaws in its Agent Development Kit was less complete. Porat described a built-in development assistant in ADK that stays reachable over its HTTP API even when hidden from the app listing, with no authentication by default — including on default Cloud Run deployments. An attacker could get the assistant to write and execute arbitrary Python, reaching environment API keys and the container's Google Cloud service account. Google initially treated this as a non-issue before ultimately paying a $3,133.70 bounty and shipping a partial fix. Total rewards across all findings: $17,133.70.

Why UK infrastructure teams should stop treating this as a filtering problem

The instinct in many UK security teams has been to bolt prompt-injection filters onto agent deployments and call it done. Check Point's finding — that the same bug classes turned up across every framework tested — suggests that's treating a symptom while the underlying trust-boundary design goes unexamined.

This aligns with UK government guidance. The NCSC's advice on adopting agentic AI stresses least privilege, limiting scope, avoiding long-lived credentials, secure defaults and active monitoring of agent behaviour, while its July 2026 Cyber Shield report treats agentic AI as an operational security and governance matter rather than a pure application-layer concern. NVIDIA's own hardening guidance points the same way: sandboxed execution for any tool that can run commands, strict allowlisting, and blocking writes outside a non-executable workspace.

Buyers evaluating or already running agent frameworks should ask vendors directly how checkpoint data, session state and tool-calling APIs are authenticated and isolated — not just how well the model resists jailbreak prompts. Reviewing this properly is a task for vulnerability management services that understand agentic architectures, not a one-off model evaluation.

The governance gap is real — and it's showing up in the market

Recent Computer Weekly reporting on Salesforce research found that governance is lagging adoption of agentic AI across UK organisations — many teams can name the agents they approved but far fewer can verify what those agents are actually doing in production, a gap TechRadar's enterprise coverage flags as a live operational risk rather than a theoretical one.

That gap matters more given how the attack surface extends beyond the model wrapper. A separate 2026 case saw a critical flaw in Starlette/FastAPI-adjacent tooling expose millions of AI agents, a reminder that the ecosystem around agents — web frameworks, proxies, dashboards, model-management UIs — is part of the security perimeter too. It's also why Five Eyes agencies have previously warned that rapid, ungoverned rollout of agentic AI carries risks organisations aren't ready to manage.

What to do before your next agent deployment

For UK infrastructure buyers, the practical response is to treat every agent framework as a privileged system with its own identity, network exposure and permission set — reviewed with the same rigour as any other production service. That starts with mapping trust boundaries and checking whether your teams can even answer what an agent is authorised to touch.

Concrete steps worth prioritising now: enforce least-privilege service accounts for every agent, disable or authenticate any hidden developer APIs before deployment, sandbox tool-calling execution paths, and build audit trails covering action logs, reasoning chains and human oversight points. Framing this within a Zero Trust model, and pairing it with managed detection & response tuned to agent behaviour, closes much of the gap Check Point exposed — and gives buyers evidence-based answers when a board asks what's actually running inside the business's AI stack. Teams wanting the wider threat picture should also look at more on AI agent attacks already hitting production systems.