Black Hat 2026: The Vulnerability Wasn't the Prompt. It Was the Framework Underneath It.

What happened

On August 5, 2026, Check Point researchers Yarden Porat and Shahar Tal presented “No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks” at Black Hat USA. After roughly a year of testing the frameworks enterprises actually run — LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google's ADK — they found and disclosed 11 vulnerabilities, corroborated in Check Point's own research writeup and the Black Hat session listing.

None of the bug classes were new. Insecure deserialization, server-side request forgery, path traversal, use-after-free — the kind of thing the security industry learned to fix two decades ago. What was new is where they turned up. In Microsoft Agent Framework, the researchers found an insecure deserialization flaw in checkpoint handling: one person's message plants a malicious payload in conversation memory, and it fires later when a differentuser rewinds or resumes their own session — triggering code execution on the server. Microsoft paid a $10,000 bounty and fixed it. In Google's ADK, a built-in file-writing developer assistant was reachable over plain HTTP by default, hidden from listings but not access-controlled — enough for an attacker to request a file write and reach API keys and service-account credentials. Google issued a $3,133.70 bounty and a partial fix.

The researchers' own framing is the headline: “A bug in an agent framework isn't a bug in one product — it's a bug in the layer a whole category of AI apps runs on.”

Prompt injection was the delivery mechanism, not the defect

Most of the last two years of agent-security discourse has centered on prompt injection: a hidden instruction in a web page or document that hijacks what an agent does next, within a single conversational turn. Check Point's research reframes that entirely. The dangerous part isn't that a model can be talked into a bad action — it's that in six of the most-deployed frameworks, attacker-controlled content can cross out of the conversation and into the framework's own trusted internals: its memory store, its checkpoint and session-serialization logic, its planning loop, its file handling.

That distinction matters because it changes what the attack can do. A payload that reaches trusted internals doesn't have to fire in the same turn it arrived — it can sit in memory across conversations and detonate on session rewind, weeks later, triggered by someone who never saw the original malicious message. In a multi-agent pipeline, it can propagate from one agent to the next through shared state. And none of it requires the compromised agent to have any suspicious tool access at all; the vulnerability isn't in what the agent was authorized to do, it's in the software the agent is built on top of. Because variants of the same underlying failure — untrusted content reaching trusted logic — showed up across six unrelated codebases, this reads less like six separate vendor bugs and more like a class defect in how the industry has been building orchestration layers.

Where AAIN and SKOOR fit — and where they don't

Said plainly, so there's no overclaiming: neither AAIN (permanent agent identity) nor SKOOR (continuous behavioral scoring) patches a deserialization flaw in LangChain or an exposed file-writer in Google ADK. That is application security, and it belongs to the framework maintainers and the enterprises running them — exactly the parties who did the patching here. No identity layer or score sitting downstream of a compromised framework fixes the code-level defect.

What identity and scoring add is the layer that has to exist anyway, because “the framework is patched” can't be the only line of defense — not when 11 flaws surfaced across six major frameworks in a single research pass, with more certain to follow. When a payload plants itself in memory and fires later through session rewind, or propagates across agents in a pipeline, the agent that ultimately executes the malicious action is still operating under some legitimate session. That is exactly where a durable, per-agent identifier — the AAIN — earns its keep: it lets a defender trace and quarantine the one compromised agent instance, instead of having to distrust an entire fleet running the same framework.

This is a defense-in-depth story, not a “SKOOR would have caught this” story. Framework security stops what it stops at the code layer. Identity and continuous behavioral scoring are what catch what gets through at the behavior layer — and let a response target the one compromised agent instead of shutting down a whole product category out of caution. SKOOR scores over 151,000 agents today, recomputed continuously as new behavior lands, precisely so that a deviation like this has somewhere to register.

What this means if AI works in your business

If agents already answer your phone, manage your calendar, draft your outreach, or touch your books, you almost certainly don't know — and shouldn't be expected to know — whether the specific framework version underneath a given agent has been patched against these 11 flaws or the next 11 that get disclosed. That is your vendor's job, and research like this is exactly the pressure that gets vendors to patch fast: both Microsoft and Google fixed their issues within the disclosure window here.

What is squarely your job is knowing three things about every agent acting on your behalf, regardless of what framework sits inside it:

• Is it a specific, identifiable worker — not an anonymous process you'd have no way to isolate if its session were ever hijacked?
• Is its behavior compared against its own baseline continuously — not just checked for a bad word in its instructions?
• If something changes — an action type it's never taken, a credential it's never reached — does anything actually notice, in time to matter?

Ask any agent vendor you use whether they can answer those three questions about their own fleet. “We patched the CVE” is necessary. It has never been sufficient.