Security gap: LangChain, AutoGPT, and OpenAI Agents SDK fail every one of six safety principles for agentic AI systems

Security audit of three leading agentic frameworks reveals systemic flaws

Researchers Md Jafrin Hossain, Mohammad Arif Hossain, Weiqi Liu, and Nirwan Ansari have published a paper that will unsettle the developer community building publicly accessible AI systems. The study, accepted at the ICML 2026 AI4GOOD workshop, methodically verified whether three dominant agentic frameworks — LangChain, AutoGPT, and OpenAI Agents SDK — are safe for deployment in high-stakes public services.

The answer is unambiguous: none of the three frameworks satisfies any of the six safety principles the authors derived from a compositional model of agentic architectures.

What are “containment principles” and why do they matter?

The authors start from the concept of containment principles — six foundational requirements that an agentic AI system must meet to be safe in public-facing applications. These principles cover areas such as memory integrity, data protection, and policy enforcement.

A particularly alarming finding concerns memory integrity: defenses against one of the most common vulnerability classes are absent in all three evaluated frameworks. This means an attacker who manages to corrupt an agent’s memory can permanently and silently alter the data the agent uses to make decisions — without any detection.

An alarming 88.9 percent wrongful denial rate

To demonstrate the practical consequences of this gap, the researchers constructed a simulated government social services application. The scenario is not theoretical: millions of citizens worldwide already use AI assistants that manage applications for government benefits, medical care, or financial assistance.

A single memory attack on the agent produced the following measured effects:

• Wrongful denial rate rose to 88.9% for targeted applicants
• Compound policy attacks increased the overall wrongful denial rate by 3.5 times, while the system’s aggregate accuracy remained superficially acceptable

The latter finding is particularly insidious: aggregate accuracy metrics can appear healthy while the system simultaneously and systematically harms a specific group of users. Standard monitoring would not detect this.

Mechanisms of attack on agentic frameworks

The core problem is that agentic frameworks do not distinguish between trusted and untrusted data entering the agent’s memory. An attacker can, for example, inject false records into a vector database or the agent’s short-term memory, causing the agent to permanently make incorrect decisions — even when new input data is correct. The researchers call this persistent targeted corruption, because the attack propagates across all future sessions and all tested backend configurations.

A fix with minimal overhead

Here the research also makes a constructive contribution. The authors did not merely diagnose the problem — they introduced two concrete, lightweight protection mechanisms:

1. Memory integrity validator — checks the consistency and integrity of data before the agent uses it to make decisions
2. Policy gate — an enforcement mechanism that prevents corrupted or unauthorized data from passing through the agentic processing chain

Both measures address the identified security gaps with negligible processing overhead — each call takes less than 0.2 milliseconds. There are no practical obstacles to deploying them in production systems.

Implications for the industry

The authors’ conclusion is clear: “Current agentic frameworks may not yet meet default safety expectations for public-facing applications” in high-stakes domains such as government services and healthcare.

This is not an academic critique aimed at a single vendor — it is a systemic finding that spans an entire generation of tools on which the industry is building production systems. LangChain, AutoGPT, and OpenAI Agents SDK together cover the vast majority of the agentic development market.

For developers and technology leaders deploying agentic systems in public or regulated contexts today, this paper offers a practical path forward: the proposed solutions are lightweight, and the gaps are clearly documented. The question is not whether someone will exploit them — but how quickly organizations can respond.