Most of the argument about prompt injection has been about the model: how to stop an AI agent being talked into doing something it should not. Two Check Point researchers told Black Hat this week that the industry is watching the wrong layer. The damage, they argue, happens when attacker-controlled text crosses out of the model and into the framework's own plumbing.
Shahar Tal and Yarden Porat audited the four frameworks a large share of the industry is actually building agents on: LangChain, Google's ADK, Microsoft Agent Framework and CrewAI. Across the four they found 12 CVEs.
The framework fires the payload itself
The part that landed hardest with the room was how little the attacker has to do. Treating prompt injection purely as a model behavior problem, or purely as tool misuse, misses the components that were never designed to handle hostile input in the first place: the serialization code that writes an agent's state to disk, the caching layer, the file parsers.
In several of the cases Tal and Porat found, nobody calls the dangerous function at all. A poisoned document lands in the agent's memory, and the framework's own save and reload behavior sets off the payload without any further prompting. There is no moment where a human or a model decides to run something. The framework does it as part of housekeeping.
Why this keeps happening
Their closing point was that most of these are not exotic bugs. They are flaws the security community has known how to find and fix for years, unsafe deserialization and parser handling of untrusted input among them. The difficulty is recognizing an old bug class once it has moved into a new part of the stack, where the people writing the code are thinking about agents and tools rather than about a file being written and read back.
It is a pattern IntelFusions has covered before from different angles. In June, researchers found flaws in a popular AI agent framework that let attackers hijack servers through its state-persistence layer. This week we reported on hidden text in Word documents turning Copilot into a self-spreading worm. Both share the same shape as the Black Hat findings: content the attacker controls reaching machinery that assumed it would only ever see trusted data.
What you should do
Check Point's recap does not enumerate the 12 CVEs or name affected versions, so the practical first step is to check the advisories from LangChain, Google, Microsoft and CrewAI directly and update to current releases. Beyond patching, the finding argues for treating anything an agent ingests as untrusted all the way down, not just at the prompt boundary: documents, tool output and retrieved web content should be assumed hostile by the serialization and caching code too, and agent memory files should be handled like any other attacker-influenced input. Where an agent runs with credentials or filesystem access, sandboxing that process limits what a payload fired by a reload can reach.
Tal and Porat's talk was one of three Check Point Research sessions on the day, alongside a kernel driver analysis by Jiri Vinopal and a deobfuscation pipeline for compiled V8 bytecode malware from Aleksandra Doniec. Check Point's summary of all three is in its Black Hat day two recap.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.