# prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside: Prompt Injection Is Not the Bug: Check Point Discloses 11 Flaws Inside the Agent Framework Runtimes

> Prompt Injection Is Not the Bug: Check Point Discloses 11 Flaws Inside the Agent Framework Runtimes is a high-severity remote code execution issue in LangChain, an AI agent. Affected: LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, Google ADK (11 disclosed flaws; one Microsoft CVE, Google partial fix without a CVE).

- **Canonical URL:** https://catalog.anomity.ai/vuln/prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside
- **Aliases:** ti-070
- **Severity:** high
- **Attack type:** Remote code execution, Prompt injection
- **Component:** LangChain (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-08-05
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside

## Summary

After a year spent examining LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, Check Point researchers Yarden Porat and Shahar Tal disclosed 11 vulnerabilities showing that prompt-controlled content crosses the boundary into trusted framework logic itself. The agent stays exploitable through memory, state, routing and orchestration even with no tools attached, so stripping tool access is not a containment boundary, which is how most teams currently reason about agent blast radius. Microsoft accepted a checkpoint-deserialization flaw reaching remote code execution, paid a 10,000 dollar bounty and hardened the Agent Framework; Google first judged its ADK issues non-critical, then shipped a partial fix with no CVE assigned.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, Google ADK (11 disclosed flaws; one Microsoft CVE, Google partial fix without a CVE) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, Google ADK (11 disclosed flaws; one Microsoft CVE, Google partial fix without a CVE).

## How do I fix it?

Assume prompt injection will land and defend the layer beneath it: stop attacker-controlled content from reaching orchestration, memory, state, routing and system instructions. Patch the framework itself on the same cadence as any other dependency, isolate and expire agent memory rather than letting it persist across sessions, and never assume a tool-less agent is a contained agent.

## How do I find every machine running LangChain?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run LangChain and which version, then enforce a policy on it.

## References

- article: https://www.theregister.com/security/2026/08/05/prompt-injection-isnt-the-bug-ai-agent-frameworks-are/5283585

## Related vulnerabilities

- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos](https://catalog.anomity.ai/vuln/friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos) — high
- [CVE-2026-50548](https://catalog.anomity.ai/vuln/cve-2026-50548) — critical
- [google-patches-antigravity-ide-prompt-injection-sandbox-escape](https://catalog.anomity.ai/vuln/google-patches-antigravity-ide-prompt-injection-sandbox-escape) — high
- [CVE-2026-115726](https://catalog.anomity.ai/vuln/cve-2026-115726) — high
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside