Your agent's tool allowlist did not fire. It was never consulted.
That is the finding from Black Hat on 5 August. Check Point researchers Shahar Tal and Yarden Porat presented "No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks".
They stopped attacking the model and attacked the orchestration code around it. Check Point counts twelve CVEs across LangChain, CrewAI, Microsoft Agent Framework and Google ADK; The Register, same talk, counts eleven and adds LangGraph and AutoGen.
The bug classes: insecure deserialization, server-side request forgery, path traversal, use-after-free, cache and file-parser flaws. Check Point's framing: bugs "the security community already knows how to fix", the challenge being "recognizing them once they've moved into a new part of the stack."
The mechanism: a poisoned document lands in the agent's memory, and the framework's own save-and-reload behaviour fires the payload. No tool call. No dangerous function the agent chose to invoke.
Every control you built at the tool boundary sits above the place the code actually runs.
Now the European part, and it is not the AI Act.
This is ordinary product security, so it is the Cyber Resilience Act. Article 3(14) defines an open-source software steward as a legal person "other than a manufacturer". Article 24 gives that steward two duties: document a cybersecurity policy, cooperate with market surveillance authorities. That is close to the entire list.
Article 13(5) puts the weight elsewhere: manufacturers "shall exercise due diligence when integrating components sourced from third parties" — expressly including free and open-source ones never placed on the market commercially.
The framework has no manufacturer. The moment you ship it inside your product, you are one.
Same week: CISA catalogued CVE-2026-9198 as actively exploited. Langflow, unauthenticated remote code execution, CVSS 9.8, fixed weeks earlier.
What I'd do Monday:
1. Put agent frameworks in your bill of materials, with versions. They are application dependencies, not "AI".
2. Audit default deployments. The Langflow chain needed no misconfiguration.
3. Threat-model serialization: checkpoints, memory, saved state. Reload executes, so agent state is untrusted input.
4. Read the US exploited-vulnerabilities catalogue as early warning. The EU publishes none, and the 11 September reporting trigger is an actively exploited vulnerability.
Which of your dependencies is a framework you have never threat-modelled?
#AgenticAI #CyberResilienceAct #AppSec #AIEngineering #Berlin
AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.