The Runtime Is the Bug
AI security keeps staring at the prompt. Eleven vulnerabilities disclosed across six agent frameworks show the deeper risk is often the code underneath it.
Much of the recent AI security argument has centered on the prompt. The vulnerabilities Check Point brought to Black Hat this week live one layer down, in the plumbing, and most belong to bug classes security teams have known for decades.
The agent doesn’t always need a dangerous tool. Sometimes reading the wrong thing is enough
According to The Register’s account of the briefing, Check Point researchers Yarden Porat and Shahar Tal discussed eleven disclosed vulnerabilities spanning LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google’s Agent Development Kit at Black Hat USA on Wednesday, August 5, 2026. The publication described several of the flaws as critical.
Tal put it plainly: most of what they found did not belong to some new frontier class of AI vulnerability. The list included insecure deserialization, server-side request forgery, path traversal and use-after-free.
Old bugs. New execution layer … and that distinction matters
Where the code actually runs
I’ve spent two pieces this summer writing about authority: who an agent acts as and who answers for what it does. Both pieces assume the framework holding that authority does its job.
This is what happens when it doesn’t.
Take LangGraph’s checkpointer. A checkpointer stores workflow state so an agent can resume from an earlier point, inspect its history or recover after an interruption. Check Point’s research focused on applications that exposed LangGraph’s get_state_history() function with an attacker-controlled filter while using a vulnerable persistence component. It was not every LangGraph deployment and it did not affect LangChain’s PostgreSQL-based managed deployment.
The first flaw in the chain, CVE-2025-67644, was SQL injection in the SQLite checkpointer.
A user-controlled filter key was interpolated into a SQLite JSON path expression rather than handled safely. With a crafted key, an attacker could alter the query and append a UNION SELECT. The important detail is what that union produced: not a new checkpoint written into the database, but a fabricated row inserted into the query’s returned result set.
That fake result could carry attacker-controlled serialized data.
When the application processed what the database returned, the checkpointer treated the row like saved state and deserialized it. That reached the second vulnerability, CVE-2026-28277, an unsafe msgpack deserialization flaw capable of invoking imported Python callables with attacker-supplied arguments. Chained together under the conditions Check Point described, the two flaws produced remote code execution on the application server.
The prerequisites matter.
The affected application had to expose the vulnerable history-filtering path to attacker-controlled input and use the vulnerable SQLite checkpointer. The deserialization flaw was not, by itself, a magic remote shell against every LangGraph installation. Its advisory treated it as a post-exploitation issue because an attacker first needed a way to place or introduce malicious serialized state. In Check Point’s demonstrated chain, the SQL injection supplied that path.
The SQLite injection was fixed in langgraph-checkpoint-sqlite 3.0.1. The msgpack issue was fixed in langgraph 1.0.10. Check Point also reported a related injection flaw in the Redis checkpointer, CVE-2026-27022, fixed in langgraph-checkpoint-redis 1.0.2.
No model jailbreak was required for the demonstrated SQLite-to-deserialization chain.
That doesn’t make the model irrelevant to the larger research. Some of the broader findings involved prompt-controlled material crossing into trusted framework behavior. But in this LangGraph case, the exploitable path lived in ordinary application input, query construction and deserialization.
The runtime was enough.
The bugs without public identifiers
Two other disclosures are harder to track because, according to Check Point and contemporaneous reporting, they had not received CVE identifiers as of August 6, 2026.
Google’s Agent Development Kit included a development-oriented component capable of writing files. Check Point reported an attack path in which generated Python could execute when imported, exposing credentials available to the process. The Register reported that Google initially disputed the finding, later made changes and paid a bounty of $3,133.70. Because I could not locate a primary Google advisory confirming every part of that timeline, those details should remain attributed to the reporting rather than stated as Google’s public account.
Microsoft Agent Framework had a different failure mode. Check Point found that one user’s prompt-injected content could place a malicious payload into checkpoint data. When another user rewound a session and the framework deserialized that state, the payload could execute on the server. Microsoft told The Register that it hardened the framework against the demonstrated path and paid a $10,000 bounty. The company did not issue a CVE because the framework was not generally available when the issue was reported.
That explanation describes a release state.
It does not make the technical failure less real. But it does affect how confidently we can describe exposure. A pre-release vulnerability is not evidence of broad production deployment, and it should not be written as though it were.
The narrower point is enough: without a public advisory or identifier, defenders have less structured information to search for later.
Not one team grinding one axe
Microsoft’s own security advisories document related execution risks inside Semantic Kernel.
CVE-2026-26030 affected the Python SDK’s InMemoryVectorStore filtering logic. Microsoft’s advisory identifies it as a critical remote-code-execution vulnerability and fixes it in semantic-kernel 1.39.4.
CVE-2026-25592 affected SessionsPythonPlugin in Semantic Kernel’s .NET SDK. A file-transfer function exposed to agent function calling could write to an attacker-selected local path unless the application added its own validation. Microsoft fixed the affected .NET component in version 1.71.0 and recommended an allowlist around file-transfer paths as a workaround.
Those advisories are more careful than the story we sometimes tell around them. One flaw created a remote-code-execution path inside vector-store filtering. The other enabled arbitrary file writes through an agent-callable plugin. Depending on the host and target path, that write could become part of a larger execution chain.
That is the real pattern.
Model-controlled or attacker-influenced data reaches an ordinary dangerous sink: eval, deserialization, a filesystem path, a shell or a query builder.
OWASP already has language for one part of this. LLM05 in the 2025 Top 10, Improper Output Handling, covers systems that pass model output downstream without sufficient validation. OWASP lists SSRF, privilege escalation and remote code execution among the possible backend impacts and specifically warns about model output reaching functions such as exec or eval.
That category does not explain every framework bug in Check Point’s research. A SQL injection in a user-controlled filter is still a SQL injection. Unsafe deserialization remains unsafe deserialization.
AI did not invent these defects.
It placed them underneath software that can read repositories, handle credentials, retain state and act with someone else’s authority.
The unscored layer
Prompt injection still deserves the attention it gets.
A January 2026 Systematization of Knowledge paper by Narek Maloyan and Dmitry Namiot synthesized 78 studies published between 2021 and 2026, catalogued 42 attack techniques and reported attack-success rates above 85 percent against state-of-the-art defenses when adaptive strategies were used. The paper is an arXiv preprint, not proof that every agent or defense fails at that rate, but it is strong evidence that prompt injection remains unresolved across the systems surveyed.
What the Check Point disclosures add is a second question.
Even when we measure whether the model can be manipulated, are we measuring what happens after manipulated content reaches the framework?
That is the unscored layer: the code the benchmark assumes will safely receive whatever the model emits.
Sometimes it doesn’t.
The disclosure system has a similar blind spot. In April, The Next Web reported research by Aonan Guan against Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action and GitHub’s Copilot Agent. Malicious instructions placed in GitHub-controlled content could be consumed as trusted context and used to expose secrets through the agents’ own workflow output. Anthropic paid $100 and GitHub paid $500. TNW reported that Google also paid a bounty, but described the amount as undisclosed. None of the three findings had received a CVE or public security advisory at the time of that report.
That last point needs precision.
A CVE is not the only way security tooling discovers risk. Scanners can use vendor advisories, GitHub Security Advisories, package metadata, custom signatures and other feeds. But CVEs remain one of the main identifiers used to correlate a vulnerability across advisories, dependency tools, asset inventories and remediation systems.
No identifier does not make a flaw invisible.
It does make correlation harder.
So the frameworks get patched. Ordinary bugs, ordinary fixes.
What still feels missing is the layer meant to notice that the runtime itself has changed underneath the benchmark. The control that asks whether attacker-influenced data reaches a deserializer, query builder, path operation or dynamic evaluator before any model score matters.
Check Point describes LangGraph as receiving more than 50 million downloads per month. Package downloads are not the same as unique users or deployed systems, but the number still gives the blast radius some shape.
The argument is not that prompt injection was a distraction.
It is that prompt injection was never the whole system.
We kept staring at the sentence the model read.
The bug was waiting in what read the model.
Resources
From SQLi to RCE: Exploiting LangGraph’s Checkpointer - Check Point Research’s primary technical disclosure. Covers the SQLite SQL injection, unsafe msgpack deserialization, Redis injection, exploit prerequisites, affected configurations, disclosure timeline and remediation information.
CVE-2025-67644: LangGraph SQLite Checkpointer SQL Injection - NIST’s vulnerability record for the SQLite checkpointer injection used in Check Point’s demonstrated exploit chain.
CVE-2026-28277 / GHSA-g48c-2wqr-h844: Unsafe Msgpack Deserialization - GitHub’s reviewed advisory for the LangGraph checkpoint deserialization flaw. Documents the post-exploitation prerequisite, affected versions, remediation and the absence of known exploitation in the wild.
CVE-2026-27022: LangGraph Redis Checkpointer Injection - NIST’s vulnerability record for the related injection issue in LangGraph’s Redis checkpointer.
Prompt Injection Isn’t the Bug, AI Agent Frameworks Are - The Register’s coverage of Yarden Porat and Shahar Tal’s Black Hat USA 2026 research. Includes the eleven-vulnerability overview, affected frameworks, researcher quotations, bounty amounts and reported vendor responses.
CVE-2026-26030 / GHSA-xjw9-4gw8-4rqx: Semantic Kernel InMemoryVectorStore RCE - Microsoft’s GitHub advisory for the critical remote-code-execution vulnerability in Semantic Kernel’s Python
InMemoryVectorStorefiltering functionality.CVE-2026-25592 / GHSA-2ww3-72rp-wpp4: Semantic Kernel Arbitrary File Write - Microsoft’s GitHub advisory for the arbitrary file-write vulnerability in the .NET
SessionsPythonPlugin, including affected packages, patched versions and the recommended path allowlist.LLM05:2025 Improper Output Handling - OWASP’s guidance on insufficient validation of model output before it reaches downstream components. Covers risks including SQL injection, path traversal, SSRF, privilege escalation and remote code execution.
Prompt Injection Attacks on Agentic Coding Assistants - The January 2026 Systematization of Knowledge paper by Narek Maloyan and Dmitry Namiot. Synthesizes 78 studies, catalogs 42 attack techniques and examines adaptive prompt-injection attacks and defenses. This is an arXiv preprint and should be described accordingly.
Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI and GitHub Copilot Agent - Aonan Guan’s original technical disclosure, written with contributions from Johns Hopkins researchers Zhengyu Liu and Gavin Zhong. Documents the affected GitHub agent workflows, attack paths, disclosure timelines and bounty outcomes.
Comment and Control: GitHub AI Agents as Credential Exfiltrators - Cloud Security Alliance’s independent research note analyzing the Comment and Control disclosures and their implications for CI/CD security, credential management and vendor-risk assessment.