Four Agent Framework Flaws Let Attackers Cross Session Boundaries and Bypass Authorization
What happened
Corgea's research published on October 25, 2026 identifies four distinct security advisories across widely deployed AI agent and orchestration frameworks. In Strands Agents SDK, a flaw allows agent-to-agent sessions to expose one user's data to another user's session, a cross-session data leak with direct privacy and data governance implications. LangGraph contains a namespace traversal flaw: by manipulating a dot-joined naming path, an attacker can reach configuration or data outside the intended boundary. FastMCP has an authorization bypass that activates after data has been transformed, meaning access checks that passed at intake no longer apply once data moves through the pipeline. MLflow's scoring and model-serving component allows unauthenticated outbound network requests. This flaw lets an attacker use the server to reach internal or external systems it should never contact. These findings extend a pattern covered in 253 MCP Server Bugs and Six Framework Bypasses Expose Agent Authorization Gap. They also connect to the broader attack surface documented in Orchestration Framework Flaws Make AI Workflow Pipelines a Primary Attack Target.
Why it matters
- ·Cross-session data leaks in agent frameworks can expose regulated personal data across user boundaries. This creates breach notification obligations under privacy laws and potential enforcement exposure where data segregation is a legal requirement.
- ·Authorization bypasses that activate after data transformation are invisible to controls applied at intake. Standard approval gates and access logs may show clean records even when unauthorized access occurred, undermining audit trail reliability.
- ·Unauthenticated outbound network requests from scoring components give attackers a pivot point inside the enterprise network. This turns an AI infrastructure tool into a channel for reaching systems behind firewalls, a risk that vendor due diligence programs rarely assess at this layer.
Governance controls affected
What to do now
- ☐Ask your engineering or platform team to confirm which version of Strands Agents SDK, LangGraph, FastMCP, and MLflow is running in production, and whether any of those versions are covered by the Corgea advisories published October 25, 2026.
- ☐Request confirmation that session data for different users or tenants is stored and processed in isolated environments across all deployed agent frameworks, and that no shared memory or context store bridges sessions.
- ☐Require your engineering team to map every point in the data pipeline where access controls are evaluated, and verify that authorization checks are re-applied after any data transformation step, not only at intake.
- ☐Ask whether MLflow or any other model-serving component has network egress restrictions in place, meaning it cannot make outbound requests to internal systems or the internet without explicit approval.
- ☐Add Strands Agents SDK, LangGraph, FastMCP, and MLflow to your AI vendor and dependency monitoring program so that future advisories trigger a documented review within a defined timeframe.
What to watch next
The volume of security advisories targeting AI orchestration and agent frameworks is accelerating. Regulators are beginning to treat agent infrastructure as in scope for existing data protection and operational resilience requirements. Organizations in regulated sectors should monitor whether supervisory guidance, such as the model risk management expectations already applied in banking, is extended to cover third-party agent framework dependencies. Patch and vulnerability management programs built for traditional software have not yet caught up to the cadence of AI framework disclosures. Compliance teams should expect this gap to draw examiner attention as agent deployments scale.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.