The dust had barely settled on the Black Hat USA 2026 stage when the first tweet went out: '11 vulnerabilities. Six major AI agent frameworks. All compromised.' I was sitting in a coffee shop in Mexico City, half-watching the livestream, half-reviewing the technical details that Check Point Research had just released. The names were familiar: Microsoft Agent Framework, Google ADK, LangChain, LangGraph, CrewAI, AutoGen. The vulnerabilities were not. They were not state-of-the-art adversarial attacks on large language models. They were not novel jailbreaks or prompt injection techniques that bypassed RLHF. No, these were the ghosts of security past: deserialization of untrusted data, server-side request forgery, path traversal, use-after-free. The same categories that have haunted software for decades. And in that moment, I realized that the AI industry has made a fundamental error: it has built its future on a foundation of trust, without verifying the infrastructure. The blockchain community knows this story all too well.
For those unfamiliar, these six frameworks are the backbone of the modern AI agent ecosystem. LangChain and LangGraph, from the same company, are the de facto standard for building LLM-powered applications. CrewAI is the hot new multi-agent framework. AutoGen, from Microsoft Research, is the academic darling. Microsoft Agent Framework is the enterprise play. Google ADK is the cloud-native contender. Together, they power thousands of applications, from customer service bots to automated trading agents to medical diagnosis assistants. What Check Point found was that every single one of them had a critical security flaw that allowed an attacker to escalate from a simple prompt injection to full remote code execution, cloud credential theft, and supply chain contamination.
—
The Attack Chain: A Lesson in Infrastructure Debt
The core insight from the Check Point research is not that AI agents are vulnerable—we knew that—but that the vulnerability is not in the model. It is in the framework. The attack chain is almost identical across all six frameworks: an attacker injects a malicious payload into a prompt; the LLM innocently ingests it and stores it in a checkpoint (state); later, another user or the same agent loads that checkpoint; the framework deserializes the checkpoint data without proper validation; and boom—remote code execution, SQLite injection, Redis injection, or cloud credential theft. The LLM itself is never the execution vector. It is the victim of its own infrastructure.
Take the Microsoft Agent Framework example. The researchers demonstrated a session rewind attack: after a malicious user planted a payload in a shared checkpoint, any subsequent user who restored that session would trigger a deserialization routine that executed arbitrary code. The LLM was just a tool for generating content; the real damage happened in the state management layer. This is not a new attack. It is a classic deserialization vulnerability, the same kind that brought down Apache Struts in 2017 and led to the Equifax breach. The difference is that now it is wrapped in the AI narrative, and the industry is pretending it is a new problem.
LangGraph, the state management framework for LangChain, was hit with three CVEs, all in the persistence layer. The first was a SQLite injection in the get_state_history() function—the system that allows agents to recall past sessions. The second was a MessagePack deserialization RCE during checkpoint loading. The third was a Redis injection in the checkpointer. All three are classic injection attacks that have been well understood since the early 2000s. The fact that LangGraph, a framework that manages the state of AI agents, shipped with SQLite queries that were not parameterized is not a failure of AI—it is a failure of software engineering discipline.
Google ADK’s vulnerability was perhaps the most egregious. The ADK ships with a built-in development assistant that listens on a hidden HTTP API with no authentication. The deployment command adk deploy cloud_run pushes this to Google Cloud Run, and by default, the environment is publicly accessible. An attacker who finds that endpoint can read the environment’s API keys and GCP service account credentials. This is a cloud credential leak that requires no exploit, no complex chain—just a misconfigured deployment. The developers argued initially that this was a “feature” for debugging, but the researchers pushed back. Eventually, Google did a partial fix—but without a CVE, the fix is invisible to the security community. The pattern is chilling: the same “deploy to production without authentication” mistake that has been made in web development for decades is now being repeated in the AI agent space.
—
The Systemic Pattern: We’ve Seen This Before
I have been in the blockchain space long enough to recognize the pattern. When the Ethereum Classic narrative shifted in 2017, I spent months translating technical whitepapers for Spanish-speaking newcomers, arguing that “code is law” is a moral stance, not a technical guarantee. The same naivety is now infecting the AI agent ecosystem. The industry is so focused on the magic of the model that it ignores the mundane reality of the infrastructure. The result is a systemic repetition of security debt.
The six frameworks share a common language: Python. Python’s ecosystem has a long history of deserialization vulnerabilities—pickle, MessagePack, yaml. The agent frameworks adopted these as default checkpoint mechanisms without considering the security implications. The logic was simple: “We need to serialize and deserialize complex state quickly. Use MessagePack. It’s fast.” But the assumption that the state data is trusted is exactly the mistake. The same assumption led to the 2015 Apache Commons Collection disaster in Java. The industry learned nothing.
We chart the code, but the soul chooses the path. The code of these frameworks is now public, the vulnerabilities are known. But the path forward depends on a fundamental change in mindset. The blockchain community learned that security is not a feature; it is a property of the system design. Smart contracts are audited, bug bounties are paid, and decentralized execution is enforced. But the AI agent frameworks are operating in a centralized, trust-on-us model. They are building the equivalent of a bank vault with a cardboard door, and then investing in the most sophisticated alarm system on the market. The alarm is the LLM alignment. The cardboard door is the deserialization of untrusted data.
—
The Commercial Implications: Bounty Payouts as a Measure of Neglect
The total bounty paid for these 11 vulnerabilities was $17,133.70. That is less than the cost of a single entry-level security engineer’s annual salary in San Francisco. Microsoft paid $10,000 for a remote code execution vulnerability in their Agent Framework. Google paid $3,133.70 for an unauthenticated cloud credential leak. The remaining nine vulnerabilities were compensated with a combined $4,000. To put this in perspective, the Google VRP regularly pays $5,000 to $30,000 for high-risk RCE vulnerabilities. The AI agent bounty is a pittance. It signals that the industry does not yet value security as a component of commercial viability.
This is a mispricing of risk. The vulnerabilities disclosed at Black Hat are not hypothetical. In a multi-user agent environment, a single malicious prompt can lead to a full system compromise. In a cloud deployment, an unauthenticated API can leak credentials that control an entire cloud account. The cost of a single incident—a breach, a data leak, a ransomware attack—would dwarf the bounty. But the industry is still in the “growth at all costs” phase, where security is an afterthought.
I remember the DeFi summer of 2020, when MakerDAO was my focus. I wrote critiques of the over-collateralization model and warned about oracle risks. The market was too busy chasing yield to listen. The same thing is happening now: the AI agent market is too busy chasing adoption to invest in the security infrastructure that will be needed when the real attacks begin. The difference is that DeFi had the benefit of learning from the DAO hack, the Parity wallet bug, and the numerous flash loan attacks. The AI agent industry is about to learn its own painful lessons.
—
The Contrarian Angle: Decentralization as the Missing Layer
The conventional wisdom in AI safety circles is that the solution lies in better model alignment, more robust guardrails, and improved prompt injection defenses. But Check Point’s research shows that the model is not the problem. The problem is the runtime. The problem is that the checkpoint data is not cryptographically signed. The problem is that the state management relies on a single SQLite database. The problem is that the deployment pipelines do not enforce authentication by default.
The contrarian conclusion is that the solution is not more security audits or better deserialization libraries—though those are necessary. The real solution is a fundamental architectural shift toward decentralized, trust-minimized agent frameworks. Imagine a world where every agent checkpoint is a signed transaction on a blockchain. Where state transitions are verified by a consensus mechanism. Where the execution environment is sandboxed by a smart contract that enforces access controls. This is not a pipe dream. The tools exist: IPFS for content-addressed storage, Arweave for permanent checkpoints, smart contracts for access control, zero-knowledge proofs for state verification. The industry simply has not built them.
The blockchain community has been building these primitives for a decade. We have learned that trust is a vulnerability. The AI agent industry is building on trust—trust that the framework developers will not make mistakes, trust that the cloud provider will not misconfigure a deployment, trust that the deserialization library has no bugs. That trust is misplaced. The only way to build a resilient agent ecosystem is to assume that every component is compromised and design for that reality. This is the mindset of threat modeling. It is the mindset that the crypto community adopted after the Mt. Gox collapse. It is the mindset that the AI community must adopt now.
Code is law, until it isn’t. And code is not law when the law is written in an unparameterized SQL query. The vulnerability in LangGraph’s get_state_history() is a perfect example: the code intended to retrieve state history, but the lack of input validation turned it into a SQL injection vector. The code was law, but the law was broken. The only way to enforce the law is to make the code self-enforcing—through cryptography, through consensus, through decentralization.
—
The Ethical Dimension: Beyond Alignment to Sovereignty
This event forces us to reconsider the ethics of AI agent deployment. The current ethical framework focuses on model alignment: ensuring that the LLM does not produce harmful content, does not hallucinate, does not discriminate. But the Check Point research reveals a deeper ethical failure: the infrastructure itself is exploitable, and the owners of the agents—the users, the enterprises, the patients—are not informed of the risks. The problem is not just that an agent might say something harmful; it is that an agent might execute code that steals your cloud credentials, and you will never know until the bill arrives.
Ledgers lie. People bleed. In the blockchain world, we have learned that the ledger is only as trustworthy as the consensus that maintains it. In the AI agent world, the ledger is the checkpoint state. But the checkpoint state is not trustworthy because it can be manipulated by an attacker through a simple deserialization attack. The ethical implication is that deploying an AI agent into a production environment without a security review of the framework is a breach of duty of care. The framework vendors have a responsibility to provide secure defaults, but they are failing.
I think back to the NFT soul-bound token project I worked on in 2021, where we preserved indigenous Mexican cultural heritage on a blockchain. The entire point was to create a permanent, tamper-proof record. The checkpoint data in AI agents is the opposite: it is temporary, mutable, and easily corrupted. The irony is that the technology to make it permanent exists, but it is not being used. The soul of the internet is at stake, and we are choosing convenience over integrity.
—
The Infrastructure Blind Spot: Agent Frameworks as the New Cloud Perimeter
The Google ADK vulnerability is a wake-up call for the cloud infrastructure community. The ADK deployment command is designed to be one-click simple, but it exposes the agent to the public internet without authentication. This is not a minor oversight. It is a fundamental design flaw that treats the agent as a standalone application rather than a piece of the cloud infrastructure. The agent is not a web page; it is a service that runs with cloud credentials. The same mistake that plagued early cloud deployments—unauthenticated S3 buckets, open Elasticsearch clusters—is now being made with AI agents.
This has implications for the infrastructure itself. The agent frameworks are becoming the new perimeter of the cloud. They are the entry points for attackers to move laterally into cloud accounts. The Check Point research shows that the attack chain is not just about the agent; it is about the cloud resources that the agent can access. The Google ADK vulnerability leaked GCP service account credentials. The Microsoft Agent Framework vulnerability could lead to Azure resource access. The LangGraph Redis injection could compromise the entire Redis instance, which may be shared with other services.
Your keys, your soul, your burden. The phrase is often used to remind crypto users of their responsibility for private keys. But the same applies to AI agents: the keys to the cloud are being stored in agent environments that are not secured. The burden is on the developer to ensure that the agent is not a vector for cloud compromise. The framework vendors are not making it easy.
—
The Market Signal: A Catalyst for Agent Security
From an investment perspective, the Black Hat disclosure is a clear catalyst for the “agent security” market. The $17,133.70 bounty will be cited in every security startup’s pitch deck for the next year. It will be the equivalent of the “$1.5 million in smart contract losses” that launched the blockchain security industry. The pattern is predictable: a high-profile disclosure, a wave of criticism, and then a new category of security tools emerges. We will see agent firewalls, checkpoint signing services, runtime sandboxing, and framework vulnerability scanners. The question is whether the framework vendors will build these in-house or leave the market to startups.
I have seen this play out before. In 2022, after the bear market crash, I audited failing L1 protocols and found that most had fundamental centralization vulnerabilities. The market did not reward security; it rewarded marketing. But eventually, the adopters demanded security audits, and the vendors that invested in security survived. The same will happen here. The AI agent frameworks that prioritize security from the ground up will have a competitive advantage. The ones that treat security as a feature to be added later will be left behind.
History doesn’t just repeat; it forks. The fork is coming. The AI agent ecosystem is at a crossroads. One path leads to a future of centralized, vulnerable frameworks that are exploited by attackers and regulated by governments. The other path leads to a decentralized, trust-minimized architecture that leverages the lessons of blockchain. The choice is not technical; it is philosophical. The soul chooses the path.
—
The Takeaway: From Trust to Trustlessness
We chart the code, but the soul chooses the path. The code of the six agent frameworks is now charted. The vulnerabilities are public. The path forward is a choice. The AI industry can continue to build on the same foundation of trust—trusting the framework developers, trusting the cloud providers, trusting the deserialization libraries. Or it can embrace the principles of decentralization that the blockchain community has spent years developing: trustlessness, transparency, and cryptographic verification.
This is not a rejection of AI. It is a call to build a better foundation. The blockchain community learned that security is not an afterthought; it is a design principle. The AI agent community must learn the same lesson. The next time a prompt injection leads to a data breach, the industry will not be able to blame the model. It will have to look in the mirror, at the infrastructure that it left vulnerable. Let us not wait for that moment. Let us choose the path of integrity, of sovereignty, of decentralization. The soul of the internet depends on it.