What happened
At Black Hat USA 2026, Check Point researchers Shahar Tal and Yarden Porat presented 'No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks,' disclosing 21 findings including 12 CVEs across LangChain, CrewAI, Microsoft Agent Framework, and Google ADK. The flaws include insecure deserialization (the 'LangGrinch' bug, CVE-2025-68664, CVSS 9.3), SSRF, and sandbox escapes. In several cases, no dangerous function is called directly by the attacker — a poisoned document lands in the agent's memory/RAG pipeline and the framework's own save/reload (serialization) behavior fires the payload automatically, exposing stored API keys, cloud credentials, and enabling RCE.
Why it matters
These are core orchestration runtimes underlying a large share of production LLM agent deployments. An attacker only needs to get a malicious document or input into the agent's context (e.g., via RAG ingestion) — no direct tool access is required — to reach credential stores and potentially achieve remote code execution across every downstream application built on the vulnerable framework version.
Attack vector
Poisoned documents/inputs delivered to an agent's memory or RAG pipeline trigger insecure deserialization when the framework saves/reloads state, without the attacker needing direct tool invocation; also includes SSRF and sandbox-escape paths.
Affected systems
LangChain, CrewAI, Microsoft Agent Framework, Google ADK (Agent Development Kit)
Mitigation
Update to patched LangChain versions addressing CVE-2025-68664 (LangGrinch); Microsoft paid a bug bounty and fixed its issue (no CVE, framework was pre-GA); Google did not fully fix or CVE its ADK finding — restrict ADK's built-in dev assistant HTTP API exposure. Sandbox document parsers and limit IAM permissions granted to agent service accounts.