Securing Agent Frameworks Guide: LangChain, LangGraph, CrewAI and AutoGen

Open-source agent frameworks make it easy to give a language model tools, memory and credentials, and just as easy to ship an agent whose security depends on defaults nobody reviewed. LangChain, LangGraph, CrewAI and AutoGen are libraries, not security products: they run inside your process, with your identity, and they execute whatever their configuration allows. Each has had serious vulnerabilities, including unsafe deserialisation in LangChain and LangGraph, and each offers settings such as local code executors that are safe only in a lab. This guide covers the shared attack surface of these frameworks, framework-specific settings to check, deserialisation and state, tools and code execution, human approval, telemetry, dependency management and monitoring. It is for developers, AppSec engineers and platform teams who build or review agents on these frameworks.

Key takeaways

• The framework inherits your privileges. Everything an agent can do is set by the tools, credentials and executors you wire in; the framework will not stop a tool from doing what its code allows.
• Serialised state is an attack surface. CVE-2025-68664 in LangChain and CVE-2025-64439 in LangGraph checkpointing are both CWE-502 deserialisation flaws: treat stored prompts, checkpoints and loaded objects as untrusted input.
• Local executors are for laptops. AutoGen's LocalCommandLineCodeExecutor and CrewAI's former unsafe_mode run generated code on the host; production code execution belongs in an isolated sandbox.
• Put approvals in the graph, not the prompt. LangGraph interrupt() and LangChain's HumanInTheLoopMiddleware enforce human review in code, which a prompt instruction cannot.
• Track framework lifecycle and versions. AutoGen is in maintenance mode and CrewAI has removed its built-in code interpreter, so pin versions, watch advisories and plan migrations deliberately.

The four frameworks and their security-relevant parts

The shared attack surface is the same in all four: untrusted text enters through user messages, retrieved documents, tool results and other agents; the model turns it into tool calls; tools act with real credentials. The Agentic AI Security Guide covers the wider threat model; this guide focuses on what the framework layer adds and how to configure it.

Framework vulnerabilities to know

Langflow is not one of the four frameworks in the title, but it builds on LangChain components and shows how agent infrastructure is targeted in practice: the Langflow CVE-2025-3248 exploitation 2025 dumped AI server secrets, and the JADEPUFFER agentic ransomware 2026 combined Langflow with harvested and default credentials to destroy a production database. See the Insecure Deserialisation Guide for the underlying weakness class.

Serialisation, state and memory

Agent frameworks persist a lot: prompts, chains, conversation history, graph checkpoints and long-term memory. Every reload is a deserialisation step.

• Patch first: upgrade langchain-core to at least 0.3.81 or 1.2.5 and LangGraph checkpoint packages to 3.0.0 or later, and confirm transitive versions with a lock file rather than assuming.
• Only load what you wrote: do not deserialise LangChain objects, prompt hubs or checkpoint data from sources a user or another tenant can write to. Treat shared prompt repositories as code that needs review.
• Protect the checkpointer: the LangGraph documentation requires a durable checkpointer such as a Postgres saver in production, with InMemorySaver for testing. That database holds full agent state, sometimes including tool results and secrets: give it its own credentials, encryption at rest and network restrictions.
• Isolate threads: LangGraph scopes state by thread_id. Generate thread IDs server side and bind them to the authenticated user or tenant; never accept a client-supplied thread ID without an ownership check, or one user can resume another's agent.
• Memory poisoning: anything written to long-term memory will be read back as trusted context. See the AI Agent Memory Security Guide.

Tools, credentials and code execution

LangChain's security policy sets out three principles that apply to all four frameworks: limit permissions, anticipate potential misuse, and use defence in depth. Its examples are concrete: restrict file tools to one directory, provide read-only API keys, and scope database credentials to only the tables the agent needs.

Tool design

• Narrow tools over generic ones: a tool that runs one parameterised query is safer than a SQL tool that accepts any statement. OWASP LLM06:2025 Excessive Agency lists unneeded functionality, permissions and autonomy as the three root causes.
• Per-user identity: where a tool acts for a user, pass that user's delegated token rather than a shared service account. See the AI Agent Authorisation Guide.
• Validate arguments in the tool: enforce allowed paths, hosts, record IDs and value ranges in tool code; the model's JSON schema is a hint, not a control.
• MCP connections: the AutoGen project warns to connect only trusted MCP servers because they may run commands locally or expose sensitive information. The same applies to LangChain and CrewAI MCP adapters. See the MCP Security Guide and the AI Agent Tool and Plugin Security Guide.

Code execution settings

The sandbox options themselves are compared in the AI Agent Sandboxing and Code Execution Guide.

Human approval and control flow

A system prompt that says "ask before deleting" can be overridden by injected text. Approval must be enforced by the runtime.

• LangChain middleware: HumanInTheLoopMiddleware takes an interrupt_on map of tool names, each with allowed_decisions from approve, edit, reject and respond. Set high-impact tools (payments, deletions, external email, deployments) to interrupt and keep edit off where argument changes would bypass review.
• LangGraph interrupts: call interrupt() before the critical action and resume with Command(resume=...). The documentation warns that a node restarts from its beginning on resume, so side effects placed before the interrupt run twice: put the action after the approval and make it idempotent. Do not wrap interrupt() in a bare try/except, which swallows the pause.
• Authorise the approver: the resume call is an API request. Check that the person resuming the thread is entitled to approve that action, and log who approved what.
• Bound the loop: set maximum iterations, recursion limits and per-run budgets in every framework so a confused agent stops rather than retrying indefinitely. See the Human-in-the-Loop for AI Agents Guide.

Multi-agent delegation

CrewAI crews, AutoGen group chats and LangGraph supervisor graphs pass messages and tasks between agents. Each hop is an injection path, because one agent's output becomes another's instructions.

• Give each agent its own tools and credentials: a research agent that reads the web should not share a toolset with an agent that writes to a database.
• Restrict delegation: limit which agents may delegate to which, and do not let an agent that processes untrusted content delegate to an agent with write tools without an approval step.
• Treat agent messages as untrusted: validate structured outputs between agents against a schema before acting on them. See the Multi-Agent and A2A Security Guide.

Telemetry, tracing and data exposure

• CrewAI telemetry: anonymous usage telemetry is collected by default; setting share_crew=True adds goals, backstories, task context and outputs, which CrewAI warns may include personal data. Disable with CREWAI_DISABLE_TELEMETRY=true and OTEL_SDK_DISABLED=true; tracing is controlled separately with CREWAI_TRACING_ENABLED=false.
• Tracing services: LangSmith and OpenTelemetry exporters capture full prompts, tool inputs and outputs. Decide which data may leave your environment, redact secrets before export and protect the tracing API key as a credential.
• Error messages: verbose framework errors can leak configuration. The CrewAI "Uncrew" flaw 2025 exposed an admin GitHub token through an error message: return generic errors to users and keep detail in internal logs.
• Prototyping tools: AutoGen describes AutoGen Studio as a rapid-prototyping tool that is not production-ready, with no built-in authentication. Keep builder UIs off the internet.

Dependencies and lifecycle

• Pin and lock: these frameworks pull in many integration packages. Pin exact versions with hashes, review new integrations before adding them and generate an SBOM. See the Software Supply Chain Security Guide.
• Watch advisories: subscribe to the GitHub security advisories for each framework repository and include framework packages in software composition analysis. Map new CVEs to deployed agents within days.
• Plan for status changes: AutoGen will not receive new features, and CrewAI has removed and deprecated execution features. An agent on a maintenance-mode framework needs a migration owner and a date.
• Exposure management: inventory every deployed agent service, builder UI and checkpoint database, and confirm none is reachable from the internet without authentication.

Where identity fits

Every framework-built agent runs on non-human credentials: model provider API keys, tool API keys, database connection strings, the checkpoint store's credentials, tracing keys and often a cloud role. Frameworks typically read these from environment variables, so a single process holds all of them and any tool that can read the environment, or any code the agent runs in-process, can reach every one.

• Separate credentials by function: the model key, each tool's key and the checkpoint database credential should be distinct secrets with distinct owners, so one leak does not expose the rest.
• Load from a secrets manager at run time: fetch short-lived credentials when a tool needs them instead of baking long-lived keys into images or .env files committed with example code.
• Register agents as identities: give each production agent an owner, a documented purpose and a review date, and revoke its credentials when it is retired. See the Identity Governance for AI Agents Guide and the Secrets Management Guide.

Detection and measurement

Instrument tool calls and state access, because they are where framework misuse becomes action.

• Log: every tool invocation with agent, user, thread ID, arguments (redacted) and result status; every interrupt and its approver; checkpoint reads and writes by identity; code executor launches.
• Alert on: tool calls to high-impact tools without a preceding approval, resumes of a thread by a different user, deserialisation errors from checkpoint or prompt loading, and agents exceeding iteration limits.

Metrics

1. Percentage of deployed agents on framework versions with no known critical or high CVEs.
2. Number of production agents using local or unsafe code executors (target zero).
3. Percentage of high-impact tools gated by an enforced interrupt or approval middleware.
4. Percentage of tools running with per-user or narrowly scoped credentials rather than shared admin keys.
5. Mean time from framework advisory publication to patched deployment.

Common failure patterns

• Demo code in production: notebooks with local executors, broad tools and API keys in environment variables promoted unchanged.
• Trusting stored state: loading prompts, chains or checkpoints from writable shared stores, the pattern behind CVE-2025-68664 and CVE-2025-64439.
• Approval in the prompt: relying on instructions rather than interrupt() or middleware to stop dangerous tool calls.
• One credential for every agent: a shared admin token behind all tools, so any injected agent has full access.
• Exposed builders and default credentials: agent builder UIs and their databases reachable from the internet, as JADEPUFFER and the Langflow exploitation showed.
• Leaky errors and traces: secrets surfacing in error messages or exported traces, as in the CrewAI Uncrew flaw.

Framework mapping

Practitioner checklist

• Inventory agents by framework, version, tools, credentials and exposure.
• Upgrade langchain-core to 0.3.81 or 1.2.5 or later and LangGraph checkpoint packages to 3.0.0 or later.
• Never deserialise prompts, chains or checkpoints from stores that users or other tenants can write to.
• Remove local and unsafe code executors from production; route code execution to an isolated sandbox.
• Scope each tool's credentials to the minimum, prefer per-user delegated tokens, and validate arguments in tool code.
• Enforce approvals with interrupt() or HumanInTheLoopMiddleware for high-impact tools, and authorise the approver.
• Bind LangGraph thread IDs to authenticated users and protect checkpoint databases as sensitive data stores.
• Set CrewAI telemetry and tracing deliberately and redact secrets from all exported traces.
• Pin dependencies with hashes, monitor framework advisories and assign migration owners for maintenance-mode frameworks.

Standards and references

• OWASP: Top 10 for LLM Applications 2025
• NIST NVD: CVE-2025-68664 LangChain serialisation injection
• NIST NVD: CVE-2025-64439 LangGraph checkpoint deserialisation
• CISA: Known Exploited Vulnerabilities Catalog
• LangChain: Security policy
• LangChain: LangGraph interrupts
• Microsoft AutoGen: Command line code executors
• CrewAI: Telemetry

Related NHI Mgmt Group resources: Agentic AI Security Guide · AI Agent Tool and Plugin Security Guide · Multi-Agent and A2A Security Guide · AI Coding Agents Security Guide · Browser and Computer-Use Agent Guide