The AI Agent Bubble is Built on 20-Year-Old Plumbing

The current discourse around AI security is obsessed with the wrong variable. While the industry spends its energy debating prompt injection and model guardrails, it is ignoring a far more catastrophic vulnerability: the actual plumbing of the agent frameworks themselves.

As I see it, the industry is treating the symptom rather than the disease. We are told that the 'prompt' is the danger zone, but as researchers from Check Point recently demonstrated at Black Hat—in findings first reported by The Register—the real failure occurs when prompt-controlled content crosses the boundary into trusted framework logic. In short, the model isn't the weak link; the insecure architecture surrounding it is.

Check Point researchers Yarden Porat and Shahar Tal spent a year attempting to break the primary frameworks enterprises use to build AI applications, including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. Their findings, reported by The Register, are a sobering reminder that we are building the future of automation on a foundation of antiquated errors. The team disclosed 11 vulnerabilities, and as Shahar Tal noted to The Register, these weren't novel exploits. Instead, they were classic bugs—insecure deserialization, path traversals, server-side request forgeries, and use-after-free—that the security world learned to solve two decades ago.

The danger here is systemic. Tal argues that a bug in an agent framework isn't just a product flaw; it is a failure in the very layer that an entire category of AI applications relies upon. Because these agents are increasingly granted access to sensitive environments—reading inboxes or updating databases—the stakes of these 'old' bugs are now exponentially higher.

Consider the critical checkpoint deserialization bug found in the Microsoft Agent Framework. Agents use checkpoints to save state or rewind progress, serializing data like conversation history into storage. Check Point discovered that via prompt injection, an agent could load untrusted checkpoint data, allowing an attacker to execute malicious code on the system. Tal described a scenario where one user's message plants a payload that is later triggered when a different user rewinds their session, granting the attacker a shell on the server. Microsoft paid a $10,000 bug bounty and fixed the issue, though it did not issue a CVE because the framework was not yet a generally available product.

Then there is the Google ADK (agent development kit). Porat told The Register that the ADK includes a built-in development assistant capable of writing files that remains reachable via an HTTP API. An attacker can use this to write an agent with Python code that runs at import time and then instruct the server to run that agent. Because the API lacks default authentication, a default Cloud Run deployment allows an attacker to reach the container's Google Cloud service account and the environment's API keys. According to Check Point, Google initially viewed this as a developer inconvenience rather than a bug, though the company eventually provided a partial fix and paid a $3,133.70 bounty.

This is not a case of one vendor failing while others succeed. Tal emphasized to The Register that these same bug classes appeared across all the frameworks tested. The industry is rushing to deploy agentic AI faster than it can defend it, mistakenly believing that securing the prompt is enough. It isn't. Until we fix the insecure architecture of the frameworks, we aren't building intelligent agents; we're just building faster ways to execute 20-year-old exploits.