AI Agent Framework Flaws Enabled Unauthorized Tool Use and Remote Code Execution

Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve remote code execution. Check Point reported 11 flaws across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK, spanning insecure deserialization, SSRF, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no CVE was assigned because the product was not generally available.

A separate disclosure described a cross-platform pattern dubbed CoreBreak, where execution layers in Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned CVE-2026-18830 and automatically patched the managed service, Google fixed CVE-2026-18236 in ADK for Python version 2.5.0, and Vercel patched @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.