Nearly a dozen flaws, some critical, in major AI agent frameworks that enterprises use to build apps reveal a security failure that extends beyond prompt injection – or any single model – according to Check Point researchers.

“Our research shows a deeper failure: in many agentic frameworks, prompt-controlled content can cross the boundary into trusted framework logic itself,” Yarden Porat and Shahar Tal note in a write-up about a Wednesday Black Hat talk on post-injection exploitation across AI agent frameworks, which they also discussed with The Register.

“A bug in an agent framework isn’t a bug in one product – it’s a bug in the layer a whole category of AI apps runs on,” Tal told us. “And the agent needs no dangerous tools to be turned against you: reading the wrong document is enough. We’re building this layer faster than we know how to defend it.”


The researchers spent a year trying to break various frameworks that enterprises use including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. And across these frameworks, the team found and disclosed 11 vulnerabilities.

“Almost none of it was a completely new bug class,” Tal said. “That’s insecure deserialization, server-side request forgeries, path traversals, use-after-free. These are bugs that we learned to fix 20 years ago, and they’re sitting underneath agents that now read your inbox, or update your database.”

These are old types of threats, and the model isn’t the weak link, he added. The failure exists in the “plumbing around the model, and we think this has been overlooked,” Tal told us. “There’s a lot of research going into prompt injection and defenses, which are important, but that’s just the beginning.”

Defenders should assume prompt injection, according to the researchers. The bug is what the framework does with the injection – and in these cases, the threat hunters found that the frameworks often fail to keep attacker-controlled content in the data plane. This allows it to influence trusted orchestration, memory, state, routing, and system instructions.

For example, the duo found a critical checkpoint deserialization bug in Microsoft Agent Framework that led to remote code execution.

“Agents have checkpoints, which are a way for them to save their state or rewind to an earlier point,” Tal explained.

These checkpoints are saved snapshots of an agent’s state, or task progress at a specific moment, and they serialize data – such as conversation history – into persistent storage, so if an error occurs, the system reloads this saved state instead of starting from scratch.

In this case, Check Point’s team found an insecure deserialization issue where, via prompt injection, the agent loaded untrusted checkpoint data, and this could allow attackers to execute malicious code on the system. “One person’s message plants the payload, and then a different person rewinds their own session, which triggers the payload, and now the attacker has a shell on that server,” Tal said.

Microsoft recognized the researchers’ findings, paid a $10,000 bug bounty and fixed the issue. But because the framework wasn’t a generally available product when Check Point found the flaw, Microsoft did not issue a CVE.

Microsoft told us that it appreciated the researchers reporting the vulnerability. “We have released protections to harden the Agent Framework and prevent the concrete exploitation path demonstrated in the proof of concept,” a spokesperson told The Register. “In addition, we updated the specific checkpoint file with additional language to define the security boundary.” 

The duo also found flaws in Google ADK (agent development kit). However, Google responded differently, the researchers told us, and did not completely fix the vulnerability or issue a CVE.

“ADK ships a built-in development assistant that can write files, and it stays reachable over the HTTP API even though it is hidden from the app listing,” Porat told us. 

To break this trust boundary, an attacker opens a session, asks ADK to write an agent whose Python code runs at import time, and then asks the server to run the agent, he explained. The server then imports the file and executes the attacker’s code. 

“There is no authentication on that API by default, and adk deploy cloud_run publishes the same API, so on a default Cloud Run deployment it is reachable without credentials,” Porat said. “From there it reaches the environment’s API keys and the container’s Google Cloud service account.”

Google did not respond to The Register’s inquiries. But according to Check Point, Google initially deemed the issue not a bug.  

“We argued the consequence rather than the mechanism: code execution on that container reaches the environment’s API keys and the container’s Google Cloud service account, which is secret theft, not a developer inconvenience,” Porat said. 

Google ultimately paid a $3,133.70 bounty and issued a partial fix, we’re told.

In total, the bug hunters received $17,133.70 in rewards for their efforts.

And this isn’t a story about one vendor or framework doing a “particularly bad job,” Tal said. “If one was an outlier, this would be a story about that one vendor,” he added. “Our finding is that the same bug classes turn up in all of them.” ®

What’s your game called and what’s it about?

My game is called VILE: Exhumed, and it is about exploring an old computer and going down the disturbing rabbit hole of entitlement.

How big is the development team?

The development team is 167cm tall (it’s just me!).

How long have you been working on it?

It’s hard to measure when you work on something part-time, but somewhere between six months and a year!

What’s the origin story of VILE: Exhumed? Share what inspired you.

I made VILE because I was frustrated. I was yearning for control and agency of my own body, and so taking photos covered in blood, as grotesque as it sounds, was powerful. I was wading through difficult feelings and trauma, but it was on my terms and that was awesome. It made me feel strong.

I guess I was “inspired” by the things that had happened to me as well, and the people who were involved in those things. I had to pull from some of the darkest periods of my life, and package it up in VILE.

Talk about the power of discomfort and disgust, and how VILE uses these emotions to authentically examine the insidious nature of misogyny.

I think pulling from my real-life experience made the game feel grounded in reality — which is why some people found it so effective and related to it so heavily. It is a feeling that unfortunately too many people, mostly women, know all too well.

Final Girl Games

What does the game’s physical edition represent to you, and what’s your favorite aspect of it?

Getting to make a physical edition of the game felt like getting a second chance at a release for VILE: Exhumed. Sort of like the feelings behind making the game in the first place, and behind releasing it how we did — I felt like I was getting control back.

I also loved getting to step back into Candy and Molly’s world again, and give them a little more identity with the packaging. Getting to create a callback to Molly that wasn’t about what happened to her was a lot more emotional than I expected. I think Molly’s story in the game is quietly a lot more grounded in reality, so letting her have her moment without it being about her trauma felt really special. It felt like I was doing something nice for Molly, and for myself.

VILE became the face of financial censorship on Steam last summer — what do you feel was lost in the popular conversation?

This is a really hard question to answer — I hesitate because I don’t want to sound unappreciative for all the support last year after it was banned from Steam. I couldn’t be more grateful for the time anyone spent talking about VILE last year, and standing up for what happened to it, and what happened to me.

Pre-ban, I was really excited to hear reactions to the visual design choices I had made. I played every single female character in VILE that was shown on screen myself, all the gore special effects that were shown in game were created practically by me, and photographed myself. I think that is really cool!

I also had a lot of firsts that I think I didn’t get to fully celebrate. It was my first published game and my first game on Steam (or, well…you know). I also was really proud of the writing in the game.

Final Girl Games

Why are video games your chosen form of expression?

I think I like being able to get so specific in communicating a feeling. I can control what the player was exposed to, and when, and use that to make the experience as close to what I imagined it to be as possible.

I love the immersion of found footage films, to me they are the scariest because they place the viewer directly into the madness. I think that VILE: Exhumed takes that one step further by making players participate.

Another reason is that stories told through video games have always impacted me very profoundly, even when I was a kid, so it’s such a pleasure to create that experience for someone else.

What’s the biggest roadblock you’ve faced as a smaller developer?

Like every developer ever, time and money is something there is never enough of, but as a developer of smaller games, I think the real challenge is other people’s time. There are so many games coming out all of the time that it is harder to grab players’ attention.

What can larger companies and publishers do to better support developers like yourself?

I think I would like to use this question as a reason to highlight something I really appreciate about DreadXP — the publisher of VILE: Exhumed — in that they aren’t afraid of games with difficult subject matter, and believe firmly that there are many kinds of horror that deserve to be shared.

I think more people in general should remove the boxes placed around the genre.

Let’s bring it back home. Sell your game in one sentence:

Play an interactive video nasty.

Final Girl Games

VILE: Exhumed is available to download and play for free, with the option to pay whatever you’d like, and that money is split equally between Final Girl Games and Red Door Family Shelter, a Canadian non-profit that provides emergency housing and support. The physical edition (which, again, looks super sick) costs $9.99 and includes an eight-page booklet, classic jewel case, hand-written labels, and an archival quality CD-ROM featuring the entire game — no DRM in sight, just like the old days. Half of all proceeds still benefit Red Door.

The VILE physical edition is a limited release and the first 100 will be individually numbered. You can sign up to be notified when it goes live for purchase on the game’s website.

Routers made by the Chinese company Zbtlink are shipped with a built-in backdoor, according to a new report from cybersecurity firm VulnCheck.

VulnCheck examined 20 models made by Zbtlink and found an implant on each one’s firmware that automatically communicates with cloud servers in China. The backdoor could give the company access to other devices connected to the router’s network, says Jacob Baines, the chief technology officer at VulnCheck. 

“When you take your router and you plug it into your network, it tries to reach out to a server in China that can then fully control that router,” Baines said. 

The discovery is as close to a smoking gun as we’ve seen for an argument that many cybersecurity experts and lawmakers have been making for years: Routers from China can’t be trusted.

It’s a fear of implants like this that led the state of Texas to sue TP-Link, a router manufacturer founded in China but now headquartered in California, alleging in a February lawsuit that its routers are used by the Chinese government to launch cyberattacks in the US. 

It’s also why the Federal Communications Commission instituted a blanket ban on the sale of new foreign-made routers in March, although it’s since granted exemptions to several non-Chinese manufacturers. But nothing like Zbtlink’s backdoor has ever been found in TP-Link’s routers. 

“What makes this different – and I’ve never really seen it – is that this is just an implant. It just connects out. You don’t have to make the mistake of exposing it to the internet,” Baines said. 

Zbtlink routers are sold around the world ​under both the Zbtlink and Wiflyer brand names, including on platforms like Amazon. They’re primarily used in businesses rather than home networks, Baines said. He estimates that 100,000 are currently deployed around the world, but he wrote in his report that “the true affected population might be larger than the twenty models we examined.”

Baines tells me that it’s common for Chinese routers to be white-labeled, or rebranded to look like they’re from somewhere else.

“They look like they’re from South Korea or Germany, but really they were made in China by this one company,” he said. “And they could be using that firmware. We just don’t know.”

Zbtlink didn’t immediately respond to CNET’s request for comment.

Joe Supan is a senior writer for CNET covering home technology, broadband, and moving. Prior to joining CNET, Joe led MyMove’s moving coverage and reported on broadband policy, the digital divide, and privacy issues for the broadband marketplace Allconnect. He has been featured as a guest columnist on Broadband Breakfast, and his work has been referenced by the Los Angeles Times, Forbes, National Geographic, Yahoo! Finance and more.

See full bio

Advertisement

Nikita Bier was the face of some of the platform’s biggest changes.

After the release of Google’s Chromecast so-called ‘streaming sticks’ have remained a popular form factor, even though such technology is these days part of ‘smart’ TVs. Being curious as to what kind of hardware they put into these sticks or dongles these days, [electronupdate] decided to do his typical full teardown of a 2026 model Fire Stick HD from Amazon, including the typical nekkid die shots.

Although most of the bits inside are fairly typical, being just your typical Mediatek-sourced solution, the ceramic patch antennas for Bluetooth and Wi-Fi are a rather interesting detail, as are the purported limitations that make this the ‘HD’ version of the Fire Stick, unlike its 4K brethren.

The used Mediatek MT8698D SoC isn’t so different from the SoC in those 4K versions, with the 2025-era 4K Plus using the MT8696D, but the 4K Select using basically the same SoC as the HD version, featuring the same G310V2 GPU at 500 MHz per the Amazon Developer documentation and the same decoder block (VPU), both of which are capable of 4K video decoding. This implies that the HD vs 4K distinction is purely software-based.

After popping open the device and noting the various ICs, the NAND Flash, the Mediatek MT7902 wireless IC, the PMIC and the aforementioned SoC all have their caps popped in order to take a closer look at their dies. For reference, as one of the largest ICs, the SoC die is a mere 5.2 x 6.45 mm. The PMIC die is more interesting as usual, as this one integrates USB-PD functionality, adding quite a bit of logic to what is otherwise a fairly mundane bit of power management features.

Overall not a very surprising design, though it does tickle that thought in the back of one’s mind whether it could be turned into a ‘4K stick’ with a few software tweaks, or perhaps more simply by installing plain Android onto its 8 GB of eMMC.

Another former Uber executive is joining Travis Kalanick’s robotics and industrial AI startup Atoms, just a few weeks after it raised $1.7 billion.

Gautam Gupta, the former finance chief under Kalanick, said in social media posts on Wednesday that he has has joined Atoms as chief financial officer. Gupta spent more than four years at Uber until he left in July 2017, just a few weeks after Kalanick resigned as CEO. (Gupta had announced his intention to leave that May.)

Hiring Gupta continues a trend of Kalanick getting the Uber band back together at Atoms. Earlier this year, Atoms acquired mining autonomy startup Pronto, which is run by former Uber (and former Google) self-driving engineer Anthony Levandowski. According to LinkedIn, a number of former top Uber employees who worked with Kalanick also work at Atoms, which was previously called CloudKitchens.

“On many levels, this round is a bit of unfinished business. Fuel to complete the bits-to-atoms story arc we started at Uber, continued at CloudKitchens, and will now finish at Atoms,” Kalanick wrote when he announced the $1.7 billion funding round last month.

Uber even joined the round as an investor, reuniting the company with the founder it pushed out in 2017 after a series of scandals and complaints of widespread sexual harassment and discrimination. Uber hasn’t disclosed how much it contributed. The Information reported $100 million, a figure that TechCrunch has also been able to confirm.

Kalanick has said he wants Atoms to work on mining, food, and transportation, though his posts to date about the startup have been less about specifics and more about wanting to “go up against the final boss, Nature and its fierce resistance to change.”

Gupta invested in Uber in 2012 when he was a vice president at Goldman Sachs, and then joined the company in 2013.

“[T]he single biggest reason I joined was – Travis. I believed he possessed a magical mix of genius and intensity that made me want to bet on the person, not the market,” Gupta wrote Wednesday. “First one in, last one out, every day. Breaking down walls of regulations, unions, city bureaucracies, etc. Had he not pioneered ridesharing, I don’t think anyone else had the fortitude to fight through one adversity after another to create a whole new market worth hundreds of billions out of nothing.”

Gupta wrote Wednesday that A*, the VC firm he co-founded in 2020 after three years at Opendoor, invested in Atoms in what was the “largest investment in the history of our fund.” Gupta is stepping down from A* to take on the CFO role at Atoms, according to his LinkedIn profile.

NASA is about to launch a telescope built to unlock some of the universe’s biggest mysteries, and it turns out that same design could help protect Earth along the way.

The Nancy Grace Roman Space Telescope is set to launch from Kennedy Space Center on August 30, 2026, with a primary mission focused on studying dark matter and dark energy – the invisible forces shaping galaxies and cosmic expansion. Researchers now say its unique design also makes it unexpectedly effective at spotting dangerous asteroids headed our way (via MIT Technology Review).

What makes the Roman Telescope capable of hunting killer asteroids?

Roman carries a super wide-angle, 300 megapixel infrared camera capable of viewing a section of sky roughly 100 times larger than what the Hubble Space Telescope can see in a single glance. That massive field of view, meant for surveying galaxies and distant stars, happens to work just as well for scanning large stretches of space for asteroids at once.

Scientists say Roman could detect asteroids as small as 60 feet across, a size comparable to the asteroid that exploded over Chelyabinsk, Russia in 2013, releasing energy equal to 500,000 tons of TNT. Some software adjustments are still needed, since Roman’s system currently filters out streaks in images that could actually be asteroids.

The Roman Telescope will be a part of Earth’s defense team

Roman telescope won’t lead asteroid hunting efforts alone. NASA’s dedicated Near-Earth Object Surveyor, launching in 2027, will lead detection efforts. Roman will support it alongside the James Webb Space Telescope and the Vera Rubin Observatory. When other telescopes flag risky asteroids with uncertain orbits, Roman’s massive field of view can quickly narrow down their paths. That helps scientists decide which asteroids truly need closer study.

The timing is also notable, since Roman faced funding cut threats last year, and researchers say showcasing its planetary defense value could help secure its future with lawmakers. With over half of the largest near-Earth asteroids still undiscovered,Roman’s unplanned second job might end up being just as important as its first.

“I have no idea how they got my contact information,” says the engineer. Unlike other interviews for government jobs, the engineer says, there was no recruiter present—only Coristine was on the interview call. “Normally initial screenings are done over the phone, rather than video, to reduce bias in the process,” they say.

During the engineer’s NDS interview, they say, Coristine didn’t seem to know the skill set he was looking for. “I generally don’t know if this person is capable of evaluating a full-stack engineer,” they say, “because they themselves aren’t aware of the skill sets, tools, and things needed in this profession.” Coristine did not reply to a request for comment. (In January 2025, Coristine was one of several DOGE members who interviewed workers at the General Services Administration’s Technology Transformation Services, who were required to defend their jobs and justify their projects. At the time, employees who spoke to WIRED described meetings in which the DOGE members were not familiar with their work.)

Coristine told the engineer that the role was geared toward supporting what would become Rampart, a tool released in late June to prevent personally identifiable information (PII) from leaving a user’s browser, particularly if they’re using something like a chatbot. In an interview with the Technology Business Programming Network (TBPN) podcast, Coristine described the project as a “side quest ” and told the engineer that the NDS team of about 30 people did not include a machine-learning engineer.

The tool is similar to OpenAI’s browser-based “privacy filter,” which can detect things like a personal email, address, or account number, and mask them automatically. But exactly how this tool is meant to be used in the context of government services is unclear. In the interview with TBPN, Coristine did not offer any particular examples, though he noted the tool is significantly smaller than OpenAI’s, making it potentially more accessible in lower-bandwidth environments.

“It feels very counterintuitive because in most instances, when you are asking for PII, you want PII,” says the engineer, noting that in government work, a user might need to provide PII like their social security number or address in order to access government benefits. “You don’t want that information redacted.”

In many cases, developers can choose to encrypt certain fields that an API sends to the backend of a website, and websites that use HTTPS connections to communicate with their backends also encrypt their requests.

This is not the first time the Trump administration has tried to reinvent the wheel of government technology. Last year, as DOGE promised government efficiency through technology, its members fired technologists who were already working on exactly the kinds of projects it purported to want, even killing a flagship product in the Internal Revenue Service’s free tax filing tool. An OPM memo published last week instructed agencies to prioritize hiring technical talent.

“This does feel superfluous. My most optimistic speculation is that this is indicative of an organization that has no goals,” the engineer says, noting that the National Institute of Standards and Technology (NIST) regularly supports the creation of tools to solve complex technical problems around issues like privacy. “Why are these guys who are so closely associated with the White House wasting tax money on this little hacker project?”

Nikita Bier has stepped down as head of product at X, Elon Musk’s social media platform, after a little more than a year in the role.

Bier wrote Wednesday that he thinks it’s “time to pass the torch and demote myself to my natural state: a poster,” adding that he’ll continue to advise the company.

The serial entrepreneur and Lightspeed venture partner took over the product lead role in July 2025. He wrote Wednesday that, while in the role, he oversaw the launch of 30 new products while “protecting the integrity of the town square.”

Of course, Bier was also head of product during a number of scandals at X. Just a few days after he took the product lead role, the chatbot Grok — made by xAI, which was then a separate company owned by Musk — started calling itself “MechaHitler.” Grok has also been used by X users to generate nonconsensual nude imagery, including child sexual abuse material, which has gotten the platform in legal trouble.

“X is, and will remain, the most important communication technology in history. But running this app is a 24/7 job and it’s now time for me to take a breather,” Bier wrote Wednesday.

The terminal-based coding tool is powered by a new AI model, Muse Spark 1.2.