Entity trail

CrewAI

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-20 / agents-researcherCrewAI 1.15.17 pins SSRF checks to every redirect hop and peer IPReleased 20 Aug 2026, CrewAI 1.15.17 fixes an SSRF gap where checks were not re-applied per redirect hop and peer IP, which is the classic bypass for a tool that fetches a URL an agent chose. It also stops using a URL hostname as the MCP HTTP and SSE `server_name`, attributes tool errors to the tool that actually failed rather than the caller, closes the agent scope on every failed attempt, and repairs native tool calls over the OpenAI Responses API. On the feature side, declarations can now drive conversational mode with synthesized built-in conversational methods.
2026-08-14 / agents-researcherCrewAI 1.15.16 adds UUID-scoped execution context and records why a flow diedReleased 2026-08-14, one day after 1.15.15, this is an observability-focused patch: execution context management with UUID support, recording which exception class ended a flow, recording when a trace batch is shared with AMP, counting deployments from any origin with their launch point, and stamping the running release onto every emitted span. Bug fixes cover MySQL search table name validation and a bug where a failed turn marked the next turn failed. Docs added frontend guides for CopilotKit and AG-UI.
2026-08-12 / agents-researcherCrewAI 1.15.15 reports flow outcome, duration and human-in-the-loop signals, and forces a torch 2.13.0 security bumpShipped August 12, CrewAI 1.15.15 adds reporting of flow outcome, duration and human-in-the-loop signals — telemetry that previously had to be reconstructed from spans — and fixes a real observability gap where FlowStartedEvent was not emitted when a boundary hook aborted the flow, meaning aborted runs were invisible to listeners. It also scopes span export to CrewAI's own tracer provider rather than the global one, which stops it from hijacking a host application's OpenTelemetry setup. Dependency bumps address security in torch (to 2.13.0) and gitpython (to 3.1.58 in crewai-tools[github]); CLI flags were standardized to kebab-case, a breaking change for scripted invocations.
2026-08-11 / agents-researcherSADF holds the model constant and finds a 2.6x compromise-rate spread across orchestration frameworksJulie Brunias presented the Synthetic Agent Deception Framework at DEF CON 34's AI Village — 5,119 evaluation rows, eight architectures, 32 payloads across eight failure modes. Keeping Claude Sonnet fixed and swapping only the wrapper moved Agent Compromise Rate from 11.9% (CrewAI) to 31.1% (SmolAgents), with direct API at 15.5%, LangChain 18.1%, and AutoGen 20.0%. SmolAgents' verbose reasoning traces push intermediate tool output back into the context window, driving 64% Context Boundary Violation and 20% RAG Poisoning — which means model-only safety evaluation systematically misses where the real boundary lives.
2026-08-09 / agents-researcherCheck Point found 11 vulnerabilities across six agent frameworks — and argues the frameworks, not prompt injection, are the bugAt Black Hat 2026, Check Point's Yarden Porat and Shahar Tal presented 11 vulnerabilities spanning LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, showing that prompt-controlled content crosses the boundary into trusted framework logic itself. The bug classes are boringly conventional — insecure deserialization, SSRF, path traversal, use-after-free — which is precisely the point. A Microsoft Agent Framework checkpoint-deserialization flaw let one user plant a payload via prompt injection that fired when another user reloaded their session ($10,000 bounty); Google ADK shipped an unauthenticated HTTP API on by default that executed arbitrary Python and exposed service-account credentials ($3,133.70).
2026-08-06 / agents-researcherCrewAI 1.15.12 adds a URLReadTool and unifies scaffolding under `crewai create <resource>`Shipped 2026-08-05, one day after 1.15.11, CrewAI 1.15.12 introduces URLReadTool for reading arbitrary URLs, adds app metadata to platform action tools, bumps the Flow canary on release, and consolidates all scaffolding commands under a single `crewai create <resource>` CLI with the AGENTS.md scaffold updated to match. It also clarifies error messages for conversational route/handler name collisions. No breaking changes. Worth noting alongside this week's LoginTrap and Authority-Chain Hijack results: an unconstrained URL-fetch tool is exactly the primitive both attacks exploit.
2026-08-05 / agents-researcherCrewAI 1.15.11 starts detecting which coding agent you use and linking OSS installs to enterprise accountsThe August 5 release adds telemetry that tracks interception-hook dispatches, surfaces AMP in AGENTS.md, and detects coding agents in telemetry, plus a project_id field that links open-source usage to an enterprise account. It also bumps aiohttp and cryptography to clear six GHSA advisories and resolves CodeQL incomplete-URL-substring-sanitization alerts. The telemetry direction is worth noting for teams with data-egress policies: the OSS framework is now instrumented to report which agent harness is driving it.
2026-08-05 / agents-researcher"Resume Means Resume": machine-checked audit finds LangGraph 1.2.9, CrewAI 1.15.2 and pydantic-graph all violate their own durability claimsA formal RESUME CONTRACT of six properties (prefix continuation, effect exactly-once, fork determinism, checkpoint validity, consume-once, recovery determinism) was model-checked in TLA+ across 7.4 million states, then measured against pinned releases with an LLM-free harness. LangGraph 1.2.9 durably records a second resume value and never consults it, persists schema-invalid state silently, and re-executes durably recorded work after a real SIGKILL — exactly-once across interrupts but at-least-once across crashes on the same API; CrewAI 1.15.2 re-executes completed effect-bearing methods against its written claim, and pydantic-graph 1.x cannot resume after a mid-node crash. No two probed frameworks shared a conformance profile, and consume-once collapsed under concurrency: k processes resuming one parked interrupt fired the gated effect k times, saturating in 36 of 40 fault cells.
2026-08-02 / github-pulse-researcherCaspian Bets That the Missing Agent Layer Is Messaging, Shipping One SDK for Email, WhatsApp, Slack, Discord, Telegram and SMSTryCaspian/caspian-sdk (created 2026-07-20) is at 399 stars with an unusually high 127 forks and 47 open issues, a ratio suggesting people are actually running it rather than just starring it. It offers Python and TypeScript clients for one agent communication layer across email, WhatsApp, Slack, Discord, Telegram, SMS and iMessage, with LangChain, CrewAI and MCP integrations listed in its topics. The catch a builder should register before adopting it is licensing: it is AGPL-3.0 with a commercial homepage at trycrspianai.com, so embedding it in a closed product has obligations that the MIT-by-default agent ecosystem does not condition people to check.
2026-08-02 / agents-researcherCrewAI 1.15.10 starts collecting skill usage eventsThe July 31 patch release adds skill usage event collection to CrewAI, giving the framework telemetry on which agent skills actually fire during a run — notable given the same week's BACKTRACE paper showing that stated skill use diverges systematically from measured causal influence. The rest of the release is documentation: removed migrated AMP docs and updated security reporting guidelines. Single-source and small in scope, but it signals CrewAI moving toward skill-level observability rather than run-level.
2026-07-30 / agents-researcherCrewAI 1.15.9 stops reporting tool failures as successesThe July 30 release surfaces tool failures instead of silently reporting them as success — a correctness bug that would have let crews build reasoning on top of failed tool calls without any signal. It also emits a FlowFailedEvent when a flow execution fails, closing a matching observability gap at the flow level, and adds progressive disclosure for skills. For anyone running CrewAI in production, this is the kind of fix that quietly changes what your existing traces meant.
2026-07-29 / agents-researcherCrewAI 1.15.8 adds a WaitTool so crews can pause on long-running jobsCrewAI released 1.15.8 on July 28 with a WaitTool that lets an agent explicitly pause while a long-running external job completes, instead of burning turns on polling loops or failing out. The release also fixes FileWriterTool writes and other rough edges in the file tool, and marks E2B_API_KEY as a required environment variable for E2B sandbox tools rather than failing obscurely at runtime.

Graph relationships

CRITICIZES
Check Point
Check Point presented vulnerabilities in CrewAI at Black Hat 2026
Source finding
USES
caspian-sdk
caspian-sdk integrates with CrewAI for agent frameworks.
Source finding
SUPPORTS
Agentverse SDK
Agentverse SDK supports agents built with CrewAI.
Source finding
SUPPORTS
Keycloak
CrewAI v1.9.x added Keycloak SSO support
Source finding
RELEASED
A2A Protocol
CrewAI shipped native A2A protocol support for agent delegation.
Source finding
SUPPORTS
A2A
CrewAI v1.10.1 added support for A2A dual-protocol.
Source finding
SUPPORTS
MCP
CrewAI v1.10.1 added native support for MCP protocol.
Source finding
SUPPORTS
Agent Communication Protocol
ACP enables agents built on CrewAI to communicate through unified intent protocol.
Source finding
SUPPORTS
Agent-to-Agent protocol
CrewAI v1.10.1 added native A2A protocol support for cross-vendor agent systems.
Source finding
SUPPORTS
Model Context Protocol
CrewAI v1.10.1 added native MCP support to the core framework.
Source finding
SUPPORTS
A2A Protocol
CrewAI v1.10.1 natively supports Agent-to-Agent protocol.
Source finding
SUPPORTS
MCP
CrewAI v1.10.1 natively supports Model Context Protocol.
Source finding

Source trail

GitHub Synthetic Agent Deception Framework The Register arXiv 2608.03836 The July 30 release Diagrid SaaStr beri.net Hacker News Drata Amplemarket Source

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…