AutoGen, LangGraph, and CrewAI: Self-Propagating Prompt Payloads Target Agent Frameworks
Self-propagating prompt payloads targeting Microsoft AutoGen, LangChain LangGraph, and CrewAI enable autonomous agent-to-agent malware propagation without host code execution vulnerabilities. Malicious natural-language instructions embedded in agent inputs, tool outputs, shared memory, or poisoned templates execute within LLM reasoning loops and replicate across inter-agent message queues, state graphs, and delegation chains. Attack vectors include indirect prompt injection, recursive delegation commands, and vector database memory poisoning. Impacts include unauthorized tool and code execution, lateral movement across agent swarms, data exfiltration, orchestration logic compromise, and supply chain contamination via malicious agent skills. Remediation requires strict I/O sanitization, least-privilege tool access, sandboxed execution, and runtime monitoring of shared state.