11 Bugs in LangChain, LangGraph, CrewAI, AutoGen and Google ADK Expose Agent Internals

Check Point Research spent close to a year auditing six of the most widely deployed AI agent frameworks — LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK — and came away with 11 vulnerabilities, several rated critical, presented at Black Hat and now largely patched. The finding worth paying attention to isn't a new prompt-injection trick. It's that in each of these frameworks, content controlled by an attacker — text in a document, an email, a web page an agent reads — can cross from the model's output into code paths meant to be trusted: orchestration logic, session memory, and persisted execution state.

The LangGraph checkpointer chain

The clearest example is LangGraph, a stateful-agent framework with over 50 million monthly downloads on PyPI. Check Point found that get_state_history() passes a user-controlled filter parameter down to the checkpointer's list() method, which builds its SQL WHERE clause with direct string interpolation of dictionary keys — a classic SQL injection (CVE-2025-67644) in the SQLite checkpointer. Chained with unsafe msgpack deserialization in the extension hook (CVE-2026-28277), that injection escalates to remote code execution on self-hosted LangGraph deployments. A third, parallel bug (CVE-2026-27022) introduces the same injection class into the Redis checkpointer. LangChain's managed cloud offering, LangSmith Deployment (formerly LangGraph Platform), runs on PostgreSQL and is not affected. Teams self-hosting are urged to update to langgraph-checkpoint-sqlite 3.0.1+, langgraph 1.0.10+, and langgraph-checkpoint-redis 1.0.2+.

Microsoft Agent Framework and Google ADK

Microsoft's Agent Framework had its own critical deserialization flaw: a malicious payload smuggled in via prompt injection would sit dormant in a checkpoint file until another user rewound their session, at which point it executed and handed the attacker shell access. Microsoft paid a $10,000 bounty and patched the bug, but issued no CVE since the framework wasn't yet generally available. Google's ADK had a different problem — its default cloud deployment exposed an unauthenticated built-in development assistant capable of writing files. Attackers could get it to create Python agents that executed code at import time, reaching environment API keys and Google Cloud service-account credentials. Google paid $3,133.70 for a partial fix. Across all six frameworks, the researchers' combined bounties totalled $17,133.70.

Why this is a framework problem, not a prompt-wording problem

A bug in an agent framework isn't a bug in one product - it's a bug in the layer a whole category of AI apps runs on.

— Shahar Tal, Check Point Research

Every flaw Check Point disclosed — insecure deserialization, SSRF, path traversal, use-after-free — is a bug class the industry has known how to fix for two decades. What's changed is where these bugs now sit: underneath agents with standing access to inboxes, databases, and cloud credentials, fed by content an attacker can influence. Filtering or rewriting prompts does nothing for a SQL injection in a checkpoint query or an unauthenticated dev endpoint left open by default.

What to do if you're running these frameworks

• Patch to the fixed LangGraph checkpointer versions immediately if you self-host with SQLite or Redis, and audit whether get_state_history() filters are ever built from user or agent-controlled input.
• Check Google ADK deployments for the built-in dev assistant exposed without authentication, and confirm it's disabled or access-restricted in production.
• Treat agent framework internals — checkpointers, memory stores, orchestration state — as attack surface in their own right, not just the prompt layer.
• Isolate the credentials an agent's runtime can reach; a framework RCE is far less damaging if it doesn't land next to production API keys and cloud service-account tokens.

None of this makes prompt injection a solved problem or a non-problem — it remains the entry point in most of these chains. But treating it as the whole threat model, while framework internals stay unaudited, is what let 11 old bug classes hide under a new label.