{
  "entry": {
    "kind": "vuln",
    "slug": "prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside",
    "name": "prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside",
    "vendor": "LangChain",
    "description": "After a year spent examining LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, Check Point researchers Yarden Porat and Shahar Tal disclosed 11 vulnerabilities showing that prompt-controlled content crosses the boundary into trusted framework logic itself. The agent stays exploitable through memory, state, routing and orchestration even with no tools attached, so stripping tool access is not a containment boundary, which is how most teams currently reason about agent blast radius. Microsoft accepted a checkpoint-deserialization flaw reaching remote code execution, paid a 10,000 dollar bounty and hardened the Agent Framework; Google first judged its ADK issues non-critical, then shipped a partial fix with no CVE assigned.",
    "website": "https://www.theregister.com/security/2026/08/05/prompt-injection-isnt-the-bug-ai-agent-frameworks-are/5283585",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-05",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside",
      "aliases": [
        "ti-070"
      ],
      "title": "Prompt Injection Is Not the Bug: Check Point Discloses 11 Flaws Inside the Agent Framework Runtimes",
      "summary": "After a year spent examining LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, Check Point researchers Yarden Porat and Shahar Tal disclosed 11 vulnerabilities showing that prompt-controlled content crosses the boundary into trusted framework logic itself. The agent stays exploitable through memory, state, routing and orchestration even with no tools attached, so stripping tool access is not a containment boundary, which is how most teams currently reason about agent blast radius. Microsoft accepted a checkpoint-deserialization flaw reaching remote code execution, paid a 10,000 dollar bounty and hardened the Agent Framework; Google first judged its ADK issues non-critical, then shipped a partial fix with no CVE assigned.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Prompt injection"
      ],
      "componentType": "agent",
      "component": {
        "name": "LangChain",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, Google ADK (11 disclosed flaws; one Microsoft CVE, Google partial fix without a CVE)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-05",
      "modifiedAt": "2026-08-05",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.theregister.com/security/2026/08/05/prompt-injection-isnt-the-bug-ai-agent-frameworks-are/5283585"
        }
      ],
      "mitigation": "Assume prompt injection will land and defend the layer beneath it: stop attacker-controlled content from reaching orchestration, memory, state, routing and system instructions. Patch the framework itself on the same cadence as any other dependency, isolate and expire agent memory rather than letting it persist across sessions, and never assume a tool-less agent is a contained agent.",
      "detectedByAnomity": true
    }
  }
}