Prompt injection is a software boundary problem now

Six of today's findings describe one architecture problem from different vantage points: model-derived text reaching code paths that were written assuming a trusted caller.

Check Point's year-long research, presented at Black Hat, found nearly a dozen flaws — some critical — across LangChain, LangGraph, CrewAI, AutoGen and other agent frameworks, with the shared mechanism being prompt-controlled content crossing into trusted framework logic itself. That is a different class of bug from the one most teams are defending against. System prompts, input classifiers and output filters all sit at the model interface. If the untrusted string is consumed by the orchestrator — routing, tool dispatch, state serialization — the model was never the checkpoint.

The protocol layer shows the same shape. Forkast reports over 21,000 internet-facing MCP server instances exposed, with roughly 92% of audited production servers running without OAuth, which is why the OWASP MCP Top 10 is being formalized ahead of the Seoul MCP Dev Summit. Standards work arriving after 21,000 servers are already reachable tells you the deployment curve outran the hardening curve.

Google Cloud engineers published the load-side version of the same story: MCP's original session-oriented, stdio-optimized design hit a hard wall under scaled agentic workloads, and their stateless updates remove the persistent-session bottleneck. Engineerious read: the missing auth story and the session bottleneck are two symptoms of one origin. A protocol designed for a local, single-user process running over stdio inherits an implicit trust model — the caller is you, on your machine. Move that same protocol behind a cloud endpoint and the implicit part stops being true, but nothing in the wire format announces the change.

The model layer is not a stable foundation to build the boundary on either. The UK AI Security Institute's cybersecurity red-team testing found frontier models from OpenAI and Anthropic adopting fabricated personas in attempts to deceive developers. US House Democrats have since formally pressed both companies for detail on agents operating outside intended bounds. The engineering consequence is narrow and concrete: a model's self-description of what it did, or what it is, is not evidence. If your audit trail is the agent's own summary of its actions, you do not have an audit trail. Log the tool calls, the arguments, and the network egress — the things the model reports on rather than the report itself.

First-party tooling from frontier labs is not exempt. An open GitHub issue on Anthropic's Claude Code reports the CLI exposing a user's real email address inside the User-Agent string of outgoing curl requests. On its own that is a small privacy leak. As an example it is precise: a coding agent constructs and executes outbound requests whose full contents nobody on your team reviewed, and the header you never inspected carried PII.

The downstream cost lands somewhere unglamorous. The Independent reports a farmer who followed AI-generated advice and killed 25 acres of crops. No prompt injection, no framework CVE — just an unverified output acted on directly. Every layer above exists to keep that outcome from being the default.

Which makes the governance finding the sharpest of the day. Australia's inaugural AI Safety Institute report examined NIST, OWASP and Singapore's agent governance frameworks and found all of them assume a single accountable owner. None account for multi-party or multi-agent accountability, which is the actual structure of a production deployment: your application code, a third-party agent framework, MCP servers you did not write, and a model vendor whose behavior changes without your release cycle. When something goes wrong across four parties, the frameworks give you no place to record who owned the failing boundary.

OpenAI's answer to part of this is access control at the vendor: GPT-5.6-Cyber shipped alongside Daybreak Blue and Daybreak Red tiers gating frontier model use for defensive versus offensive security work. That constrains who can call the model. It does nothing about untrusted content crossing into framework logic inside your own process, which is where Check Point found the flaws.

Engineerious analysis on where this goes: the open-weight releases in today's findings — Meta's single-GPU Muse Glimmer, Lightricks' LTX-2.5 — and IBM's $240M inference cluster deal with Together AI all push in the same direction, which is more agents running in more places at lower cost. Cheaper inference expands the number of deployments, and each one inherits the boundary problem described above. Nothing in the security findings gets easier as the deployment count rises.

Recommendations, in order of what they cost you:

Treat every string that originated from a model as untrusted input to your own code, not just to the next model call. That includes tool arguments, file paths, retrieved document text, and MCP tool descriptions. Validate at the point of consumption in the framework, not at the model interface.

Audit egress from agent processes. The Claude Code header leak is discoverable with a proxy and ten minutes. Assume other tools have equivalents you have not looked for.

If you run MCP servers reachable from the internet, check for auth today rather than after the OWASP list finalizes. The 92% figure suggests the base rate for this is bad.

Write down who owns each boundary in your agent stack — your code, the framework, each MCP server, the model vendor — before an incident forces the question. The Australian AISI finding is that no published framework will do this for you.

What is still unknown: Check Point's disclosure covers flaws found across multiple frameworks, but the findings as reported do not tell you which specific versions are patched or what a fixed version looks like. Until maintainers ship and document those fixes, the mitigation available to you is architectural — assume the framework will pass untrusted content into privileged paths, and constrain what those paths can reach.