Three of four agent frameworks can't contain a hijacked agent

A new benchmark ran LangGraph, CrewAI, AutoGen, and the MCP authorization model against a fully compromised, prompt-injected agent. Three of the four don't offer any built-in way to limit what a hijacked sub-agent can then do. Only one showed partial containment, per the arXiv paper.

That gap matters because these are the frameworks teams reach for to wire autonomous agents into real APIs, tools, and accounts. A poisoned prompt is enough to compromise a sub-agent, and most default setups place no ceiling on what it can touch once that happens.

The researchers also built their own authorization broker to test against the frameworks, at arXiv 2609.00267. It rejected all 200,000 forged tokens thrown at it.

Then they compromised a sub-agent under bearer delegation. The broker held it to a mean of 1.5 reachable actions out of 8,100 possible, deciding each one in about 2.6 microseconds.

LangGraph, CrewAI, and AutoGen now have to explain what's stopping them from building this in.