Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-04-03 · source-backed
Security researcher Yarden Porat of Cyata disclosed four critical vulnerabilities in CrewAI, one of the most widely used agent frameworks. These aren't theoretical. They chain together, and the entry point is prompt injection.
The chain works like this: CVE-2026-2275 exploits a sandbox escape through CrewAI's SandboxPython fallback when Docker isn't available. CVE-2026-2287 achieves RCE through a Docker runtime verification failure. CVE-2026-2286 enables SSRF via unvalidated RAG search tool URLs. CVE-2026-2285 allows arbitrary file reads from unvalidated JSON loader paths. An attacker interacting with a CrewAI agent that has Code Interpreter enabled can walk from prompt injection to sandbox bypass to full remote code execution.
CERT/CC published advisory VU#221883. No official patch exists yet. The maintainers are developing mitigations including fail-closed configurations.
This lands in a week where the broader numbers are just as bad. TrinityGuard's multi-agent safety framework found a 7.1% average safety pass rate across evaluated multi-agent configurations. Seven percent. OpenClaw testing across 47 adversarial scenarios found sandbox escapes with only a 17% average defense rate. Analysis of 30,000+ skills found over 25% contained at least one vulnerability.
And here's the context that makes it sting: a 2026 Agentic AI Security Report surveying 300 enterprise leaders found 97% expect a material AI-agent-driven security incident within 12 months. Nearly half expect one within 6 months. But only 6% of security budgets are allocated to agent security.
97% expect disaster. 6% are funding defense. That's the gap.
If you're running CrewAI with Code Interpreter in anything resembling production, implement fail-closed configs today. If Docker isn't available, Code Interpreter shouldn't fall back to an unsandboxed runtime. Full stop. And if you're evaluating any agent framework, the question isn't "does it work?" It's "what happens when someone poisons the input?"
Each link below shares sources, entities, or timing with this story.
Microsoft released OpenClaw / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Microsoft released OpenClaw); both cover CVE, RCE, Security; overlapping topics (chain, code, found, full, injection).
OpenClaw uses Claude Code / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (OpenClaw uses Claude Code); both cover CVE, Full, SSRF; overlapping topics (agent, injection).
CrewAI supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (CrewAI supports MCP); both cover CVE, OpenClaw, Security; overlapping topics (agent, code, security).
Linked by a graph relationship (CrewAI supports MCP); both cover RCE, SSRF, URLs; overlapping topics (agent, found, security).
OpenClaw uses Claude Code / Shared entities / Shared topic / What happened next
Linked by a graph relationship (OpenClaw uses Claude Code); both cover JSON, RAG, URLs; overlapping topics (agent, code).
OpenClaw uses Claude Code / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (OpenClaw uses Claude Code); both cover CVE, OpenClaw; reported by the same outlet (adversa.ai).
OpenClaw uses Claude Code / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (OpenClaw uses Claude Code); both cover CVE, Security; reported by the same outlet (securityweek.com).
OpenClaw benchmarked against Claude / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (OpenClaw benchmarked against Claude); both cover CVE, RCE; overlapping topics (agent, code, configuration).