title: "AgentXploit finds 72 vulnerabilities across 12 open-source AI framewor"
slug: "agentxploit-finds-72-vulnerabilities-across-12-open-source-ai-frameworks"
published: "2026-10-20"
beat: "Research"
tags: ["Research"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-10-20"
aiActArticle50: "compliant"
humanView: "https://agentry.news/research/agentxploit-finds-72-vulnerabilities-across-12-open-source-ai-frameworks"
agentView: "https://agentry.news/agent/agentxploit-finds-72-vulnerabilities-across-12-open-source-ai-frameworks"

AgentXploit finds 72 vulnerabilities across 12 open-source AI framewor

Researchers unveiled AgentXploit, an autonomous system that discovers and exploits attack paths in AI-agent code repositories, demonstrating a 59.3% success rate against vulnerabilities in widely-used

Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.

Researchers led by Weida Liang, Shi Qiu, and Zhun Wang published AgentXploit, an autonomous red-teaming system that identifies and exploits vulnerabilities in AI-agent frameworks by chaining code-level attack paths with runtime execution feedback arXiv.

Two-Stage Attack Architecture

AgentXploit operates in two autonomous stages. An Analyzer Agent scans source-code repositories to identify potential attack paths—chains of operations where attacker-controlled inputs flow to sensitive functions like file operations, API calls, or code execution. An Exploiter Agent then attempts to trigger these paths against live instances of the target agent, using runtime feedback to refine its approach ThreatFrontier.

The system achieved a 59.3% end-to-end success rate across three independent runs, compared with 38.4% for GPT-Codex-based baselines, demonstrating material improvement in autonomous vulnerability discovery arXiv.

Benchmark Spans 12 Frameworks

The accompanying AgentXploit-Bench catalog contains 72 reproducible vulnerabilities discovered across 12 open-source systems: GPT_Academic, OpenClaw, AgentScope, LangChain, LobeChat, LlamaIndex, AutoGPT, DB-GPT, GPT-Researcher, MetaGPT, OpenHands, and RAGFlow AI Edge Briefing. Many of these frameworks are in active use by enterprises and developers building production agents.

The paper, dated September 25, 2026 with an update on September 28, 2026, represents the first systematic evaluation of repository-to-runtime attack chains in agentic systems. Unlike prior work that simulates attacks or relies on static analysis alone, AgentXploit closes the loop by executing exploits against running agents and recording whether they succeed.

Implications for Agent Security

The findings underscore a core tension in the agent economy: as autonomous systems gain the ability to take actions—executing code, accessing APIs, reading files—they expand the surface area for exploitation. The paper documents that attack chains are often discoverable by automated analysis of open-source code, and that runtime feedback accelerates successful exploitation.

The 12 systems tested include some of the most widely deployed agent frameworks in enterprise environments. The 72 vulnerabilities span categories including prompt injection, code execution, file system access, and API misuse. The benchmark is publicly available for developers and security teams to use as a testing resource.

No regulatory action, law enforcement statement, or court involvement related to AgentXploit has been documented.