The bug class every AI agent framework keeps shipping

A user pastes hostile text into an AI agent's chat. The agent saves the conversation in a checkpoint file. A second user rewinds their session. The framework reads the checkpoint, deserializes it, and runs the attacker's code on the server. That is the chain Check Point researchers Yarden Porat and Shahar Tal disclosed Wednesday in their Black Hat USA 2026 briefing "No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks." It is one of 11 vulnerabilities the team found across a year of testing against six major agent frameworks.

The Microsoft bug sits in [python/packages/core/agent_framework/_workflows/_checkpoint_encoding.py](https://github.com/microsoft/agent-framework/raw/refs/heads/main/python/packages/core/agent_framework/_workflows/_checkpoint_encoding.py). Microsoft paid a $10,000 bug bounty and shipped a fix to the file on the main branch. The vendor declined to issue a CVE because the framework was not yet generally available when the flaw was reported, so downstream coverage that calls the issue "unpatched" is wrong on the file-level fix. The framework's overall release posture is a separate question.

The bug class is not new. Insecure deserialization, server-side request forgery, path traversal, use-after-free, unauthenticated management APIs. "Bugs that we learned to fix 20 years ago," Tal said in the interview, "sitting under agents that now read inboxes and update databases." What is new is the layer they sit on.

An agent framework is the orchestration code that sits between a large language model and the things the model can do: file edits, code execution, calendar entries, money movement, database queries. The framework takes the model's output, parses it into tool calls, and dispatches them. Most of these codebases treat the model's output as trustworthy because the model is internal. A prompt that succeeds at manipulating the model becomes a remote-execution primitive the moment the framework executes a tool call derived from that output. "A bug in an agent framework isn't a bug in one product," Tal said. "It's a bug in the layer a whole category of AI apps runs on. We're building this layer faster than we know how to defend it."

The distinction the team is naming is between two layers in an agent system. The data plane is the model plus its inputs: prompts, retrieved documents, tool responses, chat history. The orchestration plane is the framework code that parses the model's output, calls tools, manages memory and state, and routes between steps. A prompt-injection defense belongs in the data plane, and most frameworks have at least one. The framework bug lives in the orchestration plane, where attacker-controlled content from the data plane is consumed as a structural input. Fixing the data plane helps with social-engineering prompts, not with the framework trusting the model's tool arguments as if they came from a developer. The Check Point framing, again, is to assume the prompt-injection precondition succeeds and to ask what the framework does with the result.

The Google ADK case is the more disquieting disclosure. Google shipped a development assistant reachable over its HTTP API without authentication, including on default adk deploy cloud_run deployments. The interface permitted code execution that reached the deployment's environment API keys and the container's Google Cloud service account. Google initially classified the issue as not-a-bug, then paid a $3,133.70 bounty and shipped a partial fix. No CVE was issued. Across the campaign, total bug-bounty take came to $17,133.70 for 11 flaws in the shared orchestration layer that production agents are now built on.

Forkast's Black Hat preview puts the scale in context. Of 121 briefings at the conference this year, 35, or 29%, cover AI security. Additional verified agent-stack briefings target Cloudflare CodeMode and Workers, and Ray-cluster compute infrastructure. The agent layer is now a target in its own right.

The buyer-side test this enables is concrete. Before adopting any agent framework, ask where it places the trust boundary between the model's output and the tool-execution, memory, state, and routing layers. If the answer is "the model is internal, we trust it," the framework will reproduce one of the 11 patterns the Check Point team found, or one of the related ones still being disclosed. If the answer describes output validation at the tool boundary, capability scoping for each tool, sandboxed execution, and a human check for irreversible actions, the framework is at least trying to defend the layer the industry is still learning how to defend.

The disclosure is the cost of the year the industry spent shipping agents before the architectural question got a public answer. The next framework to launch will face the same question. Whether it repeats the pattern is now a procurement decision, not a research one.