What Happened
On August 5, 2026, the first day of Black Hat USA 2026 briefings in Las Vegas, Check Point Research presented “No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks.” Researchers Yarden Porat and Shahar Tal demonstrated that four of the most widely used AI agent orchestration frameworks — LangChain, CrewAI, AutoGen, and Microsoft Semantic Kernel — contain exploitable logic in their core runtimes that an attacker controls without needing access to any external tool.
The attack techniques documented by Check Point include:
- Delayed-execution injection: Attacker-controlled content introduced early in a conversation executes during a later turn, bypassing input filters applied at entry points
- Cross-agent propagation: In multi-agent environments, injected content crosses trust boundaries between agents, allowing a compromised planning agent to poison worker agents without direct access
- Persistent memory poisoning: Injected content stored in the agent’s long-term memory store corrupts future reasoning and actions across sessions and users
The key finding reframes AI agent security fundamentally: the framework runtime — its memory architecture, planning loops, and serialization layers — is an attack surface independent of the tools an agent has access to. Conventional approaches that focus on restricting tool permissions do not address this class of attack.
Source: Forkast | Black Hat 2026 Briefings
Why This Matters for Canadian Organizations
Canadian organizations across financial services, government, healthcare, and professional services are deploying AI agents built on exactly these frameworks. LangChain and LangGraph underpin many of the RAG-based knowledge retrieval systems deployed in enterprise environments. CrewAI is popular for multi-agent workflow automation. AutoGen is used extensively in enterprise AI research and agentic pilot programs. Microsoft Semantic Kernel ships as part of Copilot extensibility, touching any Canadian organization using M365 Copilot with custom plugins.
Under OSFI Guideline B-13, federally regulated financial institutions must assess the risks of AI systems before deployment and maintain ongoing risk management controls. The Check Point research demonstrates that existing AI security assessments — which typically focus on prompt injection through user-facing interfaces — miss an entire class of framework-level vulnerability. An AI agent deployed in a loan processing system, regulatory reporting workflow, or customer service context built on any of these frameworks requires reassessment in light of today’s findings.
For Canadian government and public sector operators, Treasury Board Secretariat guidance on AI use requires risk classification and ongoing monitoring. Cross-agent propagation attacks are particularly relevant to government deployments where multiple AI agents share memory stores or pass context between departmental systems.
What to Do
Canadian security and AI governance teams should treat the Check Point research as a prompt to reassess deployed agent systems, not wait for vendor patches. Recommended actions:
- Inventory all deployed AI agents and identify which underlying framework they use (LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, or others)
- Review memory store configurations — if agents use shared or persistent memory, assess what data flows into the store and whether injected content from one session could affect others
- Implement output validation on agent actions before execution: treat agent-generated actions as untrusted input the same way you treat user-supplied input in application security
- For multi-agent architectures, apply trust boundaries between agents at the message level — do not assume an agent’s output is safe to pass directly to another agent without sanitisation
- Monitor framework repositories (LangChain, CrewAI, AutoGen, Semantic Kernel) for security advisories and patches responding to the Check Point disclosure
- Engage AI vendors and framework maintainers for remediation timelines, and factor those timelines into your OSFI B-13 risk treatment plans
