Research explained

AI-agent security failures can come from application design rather than the framework

Unit 42 tested similar applications built with different frameworks and found recurring risks at tool and permission boundaries.

Published 29 Oct 2026 · Material update 1 May 2025 — last time the underlying evidence changed · Evidence: high

What happened

Unit 42’s May 2025 research examines nine attack scenarios against agentic applications, including information leakage, credential theft, tool misuse, and code execution. The researchers implemented functionally similar applications using CrewAI and AutoGen.

Their finding is about application design: many demonstrated risks arose from unsafe integrations, permissions, and configuration rather than a vulnerability unique to either framework. Simply changing frameworks does not necessarily remove those design choices.

For an application review, trace what the agent can read, which tools it can call, and which actions require approval. Treat the demonstrations as research scenarios, not proof that every deployment of these frameworks is compromised. Consult the paper’s defenses and limitations before applying them to a different architecture.

Read the original source.

What we know

Evidence type
Controlled application research

What remains unknown

Open question
The demonstrated applications do not establish exposure of every deployment.

Source references