What happened
Check Point Research publicly previewed (widely reported Aug 1-2, 2026 ahead of the Aug 5 Black Hat briefing) that exploitable logic lives in the core runtimes of major agent frameworks — not just in tool-calling surfaces. Even without any tool access, injected content can hijack agent behavior via memory, planning-loop, and serialization internals, reframing agent security from "control the tools" to "the framework itself is the vulnerability."
Why it matters
LangChain, CrewAI, AutoGen, and Semantic Kernel underpin a huge share of production agentic AI deployments. If core orchestration/memory logic is exploitable independent of tool permissions, then current defensive architectures (tool allowlisting, output filtering, prompt guardrails) miss the actual attack surface, requiring a fundamental redesign of agent-framework trust boundaries across the ecosystem.
Attack vector
Attacker-controlled content injected into any input channel an agent processes (not requiring tool access) can cross trust boundaries and hijack the agent through framework-internal logic rather than through tool abuse. Disclosed techniques include delayed-execution injection that triggers across later conversation turns, cross-agent propagation in multi-agent orchestration setups, and persistent memory poisoning that survives beyond the initiating session.
Affected systems
LangChain, CrewAI, AutoGen, Semantic Kernel (agent-framework runtimes: memory stores, planning loops, serialization layers, orchestration logic)
Mitigation
No public patch yet (full technical disclosure scheduled for Black Hat USA, Aug 5 2026 briefing by Yarden Porat & Shahar Tal, Check Point Research). Interim guidance: treat agent framework memory stores and planning/serialization layers as untrusted-input attack surface; do not rely solely on tool-permissioning or prompt-level guardrails, which this research shows address the wrong layer.