11 Framework Flaws Put Every Agentic App Built on LangChain, AutoGen, and Google ADK at Risk
What happened
Check Point Research published findings, reported by Prompt injection isn't the bug, AI agent frameworks are in The Register, identifying 11 vulnerabilities across five widely deployed AI agent frameworks: LangChain, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. The vulnerabilities include insecure deserialization, path traversal, and authentication bypass flaws, representing classic software security failures embedded at the infrastructure layer rather than at the application layer. One critical flaw in Microsoft Agent Framework allowed an attacker to achieve remote code execution by triggering checkpoint deserialization through a prompt injection payload, meaning an adversarial input to a deployed agent could compromise the underlying server. A separate flaw in Google ADK enabled unauthenticated code execution and credential theft on default Google Cloud Run deployments, a configuration many enterprises use out of the box. Because these frameworks underpin entire categories of agentic applications, a single unpatched framework vulnerability exposes every application built on top of it, regardless of how well those applications have been individually hardened.
Why it matters
- ·Framework-layer vulnerabilities collapse the distinction between content safety and system security: when prompt injection can trigger remote code execution through a deserialization flaw, OWASP Top 10 for Large Language Model Applications mitigations applied at the application layer are insufficient without underlying framework patching. Compliance teams that have treated prompt injection purely as an output-quality or guardrails problem must now treat it as a system integrity issue.
- ·The credential theft vector exposed in Google ADK means agentic deployments running with service account credentials or API keys are at risk of full credential compromise, which implicates agent identity lifecycle controls and non-human identity governance across every affected environment. Organizations that have not separately inventoried the credentials accessible to their agent frameworks cannot assess the blast radius of exploitation.
- ·Third-party AI vendor risk assessments typically evaluate the vendor application, not the open-source framework dependencies beneath it. These disclosures expose a structural gap in procurement-stage and ongoing vendor risk programs: if a vendor's agentic product is built on an affected framework version, the enterprise inherits that vulnerability regardless of the vendor's own security posture.
Governance controls affected
What to do now
- ☐Inventory every agentic application in production and identify which AI agent framework and version each application uses, prioritizing LangChain, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK.
- ☐Verify that patched versions of affected frameworks are deployed; where patches are not yet available, assess whether the affected functionality can be disabled or restricted until remediation is complete.
- ☐Audit the credentials and service account permissions accessible to each agent framework deployment, and apply least-privilege scoping to limit blast radius if a deserialization or authentication bypass is exploited.
- ☐Re-scope red-teaming and adversarial testing programs to include framework-layer attack vectors, not just application-layer prompt injection, to detect exploitation paths that bypass guardrails through underlying infrastructure flaws.
- ☐Require vendors supplying agentic AI applications to disclose the framework dependencies they use, the version pinned, and their patching cadence for upstream framework vulnerabilities as part of vendor contract requirements.
What to watch next
Check Point Research has not indicated whether all 11 vulnerabilities have been fully patched by the respective framework maintainers, so compliance teams should monitor official release notes and security advisories for LangChain, CrewAI, AutoGen, Microsoft, and Google ADK. Given the pattern of exploitation documented in CISA Confirms Active Exploitation of Critical RCE Flaw in IBM Langflow, regulators and CISA may move quickly to add confirmed-exploited framework flaws to the Known Exploited Vulnerabilities catalog, which would impose mandatory patching timelines on federal contractors and create reputational pressure on commercial enterprises. Organizations operating under the EU Cyber Resilience Act should also assess whether these framework vulnerabilities trigger disclosure or conformity obligations for products they ship that incorporate affected frameworks.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.