Check Point Research took the stage at Black Hat USA 2026 with a straightforward finding: the frameworks running autonomous agents are broken at their core. Researchers Yarden Porat and Shahar Tal demonstrated how attackers can exploit LangChain, CrewAI, AutoGen, and Semantic Kernel by targeting memory stores, planning loops, and serialization layers. This isn't about fooling an agent with a clever prompt. It's about compromising the orchestration logic that holds the entire stack together.

The security focus has shifted. Instead of hardening individual tools or monitoring agent outputs, defenders now face a more fundamental problem: the runtimes themselves leak. Delayed-injection attacks can propagate across conversation turns. In multi-agent environments, a single compromised framework can spread threats like a contagion.

Four layers, four attack vectors

Black Hat presentations are dissecting the agentic stack methodically. At the compute layer, Oligo Security detailed how Ray clusters are being weaponized into self-propagating botnets through the ShadowRay 2.0 campaign. Over 200,000 servers sit exposed since September 2024, despite Ray maintainers characterizing the underlying vulnerability as a design feature for controlled environments.

The cloud platform layer presents another angle. Check Point's second briefing examined Cloudflare CodeMode and Workers, where LLM-driven orchestration becomes the target. Attackers use prompt injection to trigger code generation that runs with the agent's full privileges, breaking sandboxes and crossing tenant boundaries.

The economics are shifting too. Attack costs are collapsing. Of 121 briefings at the conference this year, 35 are dedicated to AI security, signaling that agentic systems have become the primary attack surface. This infrastructure-level research confirms what was previewed weeks earlier: agent exploitation is maturing into a distinct discipline, one that targets the glue holding modern AI systems together rather than the systems themselves.

This article covers security research and threat analysis. It is informational and not financial or investment advice.