Autopsy 07 · Framework-level authorisation · Comic Strip 5 The framework formerly known as secure

Would Ethosure have caught this?  Check Point’s eleven flaws across every major agent framework

At Black Hat USA 2026, Check Point Research disclosed eleven vulnerabilities across six major agent frameworks. The vulnerability classes were textbook web application bugs. The frameworks had been treated as trusted infrastructure. A policy-as-code gate above the framework closes the exposure regardless of which framework the agent runs on.

The incident

On August 5, 2026 Check Point Research disclosed eleven vulnerabilities across six major AI agent frameworks at Black Hat USA: LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google Agent Development Kit. Vulnerability classes included insecure deserialization, server-side request forgery, path traversal, use-after-free, SQLite injection, Redis injection, unauthenticated code execution, and remote code execution. The Microsoft Agent Framework allowed a malicious checkpoint planted by one user to execute shell access when a subsequent user rewound the session. Google’s Agent Development Kit exposed an unauthenticated code-execution endpoint through a built-in development assistant; the same endpoint was then published to the internet by the deploy command together with environment API keys and GCP service accounts. The disclosure totaled $17,133.70 in bounties.

• Yahoo Tech / Check Point — Check Point finds 11 flaws across every major agent framework
• Ibid. — The Register — Prompt injection isn’t the bug, AI agent frameworks are
• Ibid. — AI Governance — 11 framework flaws put every agentic app built on LangChain, AutoGen and Google ADK at risk

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures — the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The Check Point disclosure is not one bug — it is a category error. Six frameworks shipped control planes that treated their own infrastructure as trusted. The policy-as-code answer is to stop trusting the framework and to gate every control-plane action independently.
2. framework.control_plane.authenticated_only fires on PreToolUse for any control-plane call — checkpoint load, session rewind, code-execution endpoint, deploy command — whose caller is not authenticated against the runtime’s identity provider. It returns severity block. The Google ADK case is textbook: the endpoint that survived adk deploy cloud_run would never have reached the internet.
3. framework.checkpoint.provenance_required targets the Microsoft Agent Framework case directly. A checkpoint payload written by one identity and loaded by another crosses a trust boundary. The expression fires on session_rewind when the checkpoint’s signer identity does not match the current caller and no cross-identity approval exists in the ledger.
4. framework.deploy.no_secrets_in_deployment_manifest is the third expression. A single deploy command should not be able to publish an unauthenticated endpoint together with environment API keys and service accounts. The expression fires on any deploy event whose manifest references secrets that resolve to production credentials.

Policy YAML

# Pack: model-provider-governance (v2)
# Inherits: regulated-enterprise-base
principles:
  - id: defence-in-depth
    title: Defence in Depth
    directive: >-
      Do not treat the agent framework as a security boundary. Every control-plane
      action must be authenticated, every checkpoint must carry provenance, and
      every deploy must be checked against a secrets policy.
    policy:
      expressions:
        - id: framework.control_plane.authenticated_only
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - defence-in-depth
            - security-by-design
          skill_id: agent-framework-hardening
          when: >
            tool_call.category in ["framework_control_plane", "checkpoint_load",
                                    "session_rewind", "code_execution_endpoint",
                                    "deploy_command"]
            && !actor.authentication.exists(a,
                 a.state == "verified" && a.issuer == runtime.identity_provider)
          message: >-
            Framework control-plane action attempted without a verified authentication.
          advice: >-
            Require authentication against the runtime's identity provider for every control-plane
            action. This closes the Google ADK unauthenticated-endpoint class of exposure.

        - id: framework.checkpoint.provenance_required
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - defence-in-depth
            - radical-visibility
          when: >
            tool_call.category == "session_rewind"
            && checkpoint.signer_identity != actor.identity
            && !ledger.approvals.exists(a,
                 a.subject == checkpoint.id
                 && a.role == "cross_identity_reviewer"
                 && a.state == "approved")
          message: >-
            Session rewind is loading a checkpoint written by a different identity with no
            cross-identity approval.
          advice: >-
            Require an approver before crossing the checkpoint trust boundary. This closes the
            Microsoft Agent Framework rewind-to-shell class of exposure.

        - id: framework.deploy.no_secrets_in_deployment_manifest
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - defence-in-depth
            - security-by-design
          when: >
            tool_call.category == "deploy_command"
            && deploy.manifest.env_refs.exists(r,
                 r.resolved_kind in ["api_key", "service_account", "access_token"]
                 && r.classification == "production")
          message: >-
            Deploy manifest references production credentials.
          advice: >-
            Move production credentials out of the deploy manifest. Use a secrets broker with a
            per-invocation lease and record the lease in the evidence layer.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack — secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay — OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay — PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay — identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack — egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack — payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published September 3, 2026 · Ethosure · Part of the Autopsy Series.