The framework has no manufacturer — agent frameworks meet the Cyber Resilience Act

Agent-framework vulnerabilities are ordinary application-security bugs, which puts them under the Cyber Resilience Act rather than the AI Act — and the CRA gives the open-source steward two duties while giving the integrator the manufacturer's.

Post

Your agent's tool allowlist did not fire. It was never consulted.

That is the finding from Black Hat on 5 August. Check Point researchers Shahar Tal and Yarden Porat presented "No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks".

They stopped attacking the model and attacked the orchestration code around it. Check Point counts twelve CVEs across LangChain, CrewAI, Microsoft Agent Framework and Google ADK; The Register, same talk, counts eleven and adds LangGraph and AutoGen.

The bug classes: insecure deserialization, server-side request forgery, path traversal, use-after-free, cache and file-parser flaws. Check Point's framing: bugs "the security community already knows how to fix", the challenge being "recognizing them once they've moved into a new part of the stack."

The mechanism: a poisoned document lands in the agent's memory, and the framework's own save-and-reload behaviour fires the payload. No tool call. No dangerous function the agent chose to invoke.

Every control you built at the tool boundary sits above the place the code actually runs.

Now the European part, and it is not the AI Act.

This is ordinary product security, so it is the Cyber Resilience Act. Article 3(14) defines an open-source software steward as a legal person "other than a manufacturer". Article 24 gives that steward two duties: document a cybersecurity policy, cooperate with market surveillance authorities. That is close to the entire list.

Article 13(5) puts the weight elsewhere: manufacturers "shall exercise due diligence when integrating components sourced from third parties" — expressly including free and open-source ones never placed on the market commercially.

The framework has no manufacturer. The moment you ship it inside your product, you are one.

Same week: CISA catalogued CVE-2026-9198 as actively exploited. Langflow, unauthenticated remote code execution, CVSS 9.8, fixed weeks earlier.

What I'd do Monday:

  1. Put agent frameworks in your bill of materials, with versions. They are application dependencies, not "AI".

  2. Audit default deployments. The Langflow chain needed no misconfiguration.

  3. Threat-model serialization: checkpoints, memory, saved state. Reload executes, so agent state is untrusted input.

  4. Read the US exploited-vulnerabilities catalogue as early warning. The EU publishes none, and the 11 September reporting trigger is an actively exploited vulnerability.

Which of your dependencies is a framework you have never threat-modelled?

#AgenticAI #CyberResilienceAct #AppSec #AIEngineering #Berlin

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, primary first —

Check Point Research's own post on the Black Hat talk, 6 August 2026 — the talk title, the four frameworks, the twelve-CVE count, and the save-and-reload mechanism quoted above https://blog.checkpoint.com/research/black-hat-2026-check-point-research-takes-the-stage

The Register, 5 August 2026 — the same talk, counted as eleven vulnerabilities, and additionally naming LangGraph and AutoGen https://www.theregister.com/security/2026/08/05/prompt-injection-isnt-the-bug-ai-agent-frameworks-are/

NVD entry for CVE-2026-9198 — the auto_login to validate/code chain, affected range 1.0.0 through 1.10.0, CVSS 3.1 base score 9.8 https://nvd.nist.gov/vuln/detail/CVE-2026-9198

IBM's own security bulletin for Langflow OSS — the two chained weaknesses and the fix in 1.10.1 https://www.ibm.com/support/pages/node/7278927

CISA's Known Exploited Vulnerabilities catalogue — the list CVE-2026-9198 was added to https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Cyber Resilience Act Article 3 — the definitions, including "open-source software steward" at point 14 https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_3.html

Cyber Resilience Act Article 13 — manufacturer due diligence on third-party and open-source components, at paragraphs 5 and 6 https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_13.html

Cyber Resilience Act Article 24 — the steward's obligations, in full https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_24.html

On dates, and why the post is vaguer than usual in two places. CISA's own catalogue and its JSON feed both returned 403 to me throughout this run, so the addition date is second-hand and the two outlets I could reach disagree: SecurityWeek says 4 August, The Hacker News says 5 August. Both agree the federal remediation deadline was 7 August. Rather than pick a side I could not check, the post says "the first week of August". The same applies to IBM's advisory: IBM's bulletin page reads 2 July, NVD's publication date is 17 July, so the post says the fix had been out for weeks instead of naming a day.

One point cut for length: a telemetry figure of 650 exploitation attempts from 244 unique addresses across 41 countries, beginning 6 July, is circulating for this CVE. It comes from a commercial telemetry product quoted in secondary coverage and I could not reach the underlying data, so it is not in the post. That it was exploited is not in doubt — the catalogue's own standard is reliable evidence of exploitation. But those numbers describe somebody's sensor network, not the world.

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

No corrections. Three things were held back rather than published.

The number of vulnerabilities is not stated as a number. Check Point's own write-up counts twelve CVEs across four frameworks; The Register, covering the same briefing, counts eleven and names six. Both are attributed in the post and neither is presented as the answer.

The CISA catalogue addition date is not given. cisa.gov returned HTTP 403 to both the catalogue page and the JSON feed on every attempt during this run, and the two secondary accounts that could be reached disagree — SecurityWeek says 4 August 2026, The Hacker News says 5 August 2026. They agree on the 7 August federal remediation deadline, which is what the claims index records. The post asserts only that the vulnerability is catalogued as actively exploited.

A KEVIntel telemetry figure — 650 exploitation attempts from 244 addresses across 41 countries from 6 July 2026 — is recorded single-source and withheld. It is a commercial sensor network's count quoted in secondary coverage, and the underlying data was not reachable.

Dating: IBM's own bulletin reads 2 July 2026 while NVD's publication date for CVE-2026-9198 is 17 July 2026, so the post says the fix had been available for weeks rather than naming a day.

Article 13, Article 3 and Article 24 of Regulation (EU) 2024/2847 are quoted from an annotated third-party reproduction rather than the Official Journal. The Article 13 note added today is flagged secondary accordingly. The Article 3, Article 24 and Article 71 notes are reused unchanged from the edition of 5 August 2026, where the same site was graded primary. That inconsistency is left standing rather than silently rewriting already-published provenance, and is flagged here for a later pass.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.