Frameworks
AI agent framework security
Agent frameworks decide how tools, handoffs, memory and approvals work, which shapes where an attack lands. These pages cover the OpenAI Agents SDK and LangChain with LangGraph: what each lets an agent do, per its own docs, which risks apply, and the concrete checklist we use in an Agent Action Pentest.
Pages in this section
- Security testing for OpenAI Agents SDK appsFunction tools, handoffs, guardrails and MCP servers in the OpenAI Agents SDK.
- Security testing for LangChain and LangGraph agentsTools, permissions and human-in-the-loop interrupts in LangChain and LangGraph.
How these pages work
Frameworks do not make agents secure or insecure by themselves. They provide primitives: a way to declare tools, a way to route between agents, a place to hang guardrails, a way to pause for a human. The security outcome depends on how those primitives are wired in your code. That is why our framework pages start from each project's own documentation and then turn it into test steps.
Each page answers four questions. What the framework lets an agent do, with links to the official docs for tools, handoffs, guardrails, interrupts and MCP. Which agent risks apply and why, linking to the risk pages. A checklist tied to the framework's real primitives, for example where OpenAI Agents SDK guardrails actually run, or which LangGraph nodes sit behind an interrupt. And what access we need to run the test.
The same four VulnZap classes apply regardless of framework: prompt injection, privilege escalation, data exfiltration and unsafe actions. What changes is where to look. In one stack the gap is a guardrail that only sees the first agent; in another it is a generic SQL toolkit bound with a read-write credential.
More frameworks are planned, including CrewAI, AutoGen, LlamaIndex, the Vercel AI SDK and MCP servers as a category. Each will be added once its page can be built from cited documentation rather than guesswork.
Where a framework offers a security feature, such as guardrails or human approval steps, the page quotes the documentation on where it runs and what it inspects. Those details are where most of our findings come from, because teams reasonably assume a feature covers more than it does.
If your stack is not listed, the testing approach is the same and we agree it at intake. Tell us which framework and version you use, and which tools the agent holds, and we will confirm scope in writing before the clock starts. The fixed-price offer is described below.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Do you test the framework or my agent?
Your agent. Framework maintainers run their own vulnerability programs; we test how your code uses the framework.
Does the framework change the price?
No. The Agent Action Pentest is $2,500 fixed with scope agreed at intake.
Do you need my source code?
No. A staging deployment with realistic tools is enough. Repository access can speed up the review of tool and guardrail wiring.
Related pages
- AI agent security risksAI agent security risks with OWASP and MITRE ATLAS references: prompt injection, excessive agency, data disclosure and MCP tool poisoning, and how we test.
- AI agent security standards, mappedOWASP Top 10 for LLM Applications, OWASP Agentic AI threats and MITRE ATLAS, each mapped to what an Agent Action Pentest tests and what it leaves out of scope.
- AI agent integration securityWhat AI agents can do through Stripe, Slack, GitHub and Gmail: actions, abuse paths, least-privilege notes from vendor docs, and how we test each.
- AI agent security testing, comparedHow an agent action pentest compares with other AI security testing, such as AI red teaming, using public definitions only, and when each is the better fit.
Sources
Last reviewed: