CLAIM-2026-08-10-04

The exploitation path described requires no tool invocation by the agent: per Check Point, 'a poisoned document lands in the agent's memory, and the framework's own save and reload behavior fires the payload on its own'. Controls placed at the tool-call boundary are therefore not consulted.

Sources

• checkpointr2026black