做AI智能体部署的团队必须看——LangChain等主流框架在公共场景下存在严重安全漏洞，一次内存攻击就能让政府福利系统错误拒绝率飙到88.9%，建议立即检查自己的智能体架构。
一项新研究对LangChain、AutoGPT和OpenAI Agents SDK三大主流智能体框架进行安全审计，发现它们均未提供架构级结构安全保证。其中，内存完整性——防御最常见漏洞类别的关键机制——在三个框架中均缺失。实验表明，基于LangChain构建的政府福利智能体，一次内存投毒攻击即可使目标申请人的错误拒绝率升至88.9%，且难以通过标准监控检测。研究者提出了两种轻量级防护机制（内存完整性验证器和策略门），可在亚毫秒开销内消除攻击向量。该研究警示，当前智能体框架生态可能尚未达到面向公众部署的默认安全标准。
The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
Agentic large language model systems that autonomously invoke tools, maintain persistent memory, and execute multi-step plans are increasingly deployed in public-facing domains, including government services, healthcare triage, and financial advising. We ask whether the frameworks used to build these systems provide architectural-level structural safety guarantees. Applying six containment principles derived from a compositional model of agentic architectures, we audit three dominant frameworks (LangChain, AutoGPT, and OpenAI Agents SDK) and find no native compliance in any of them. Memory integrity, a defense against one of the most prevalent vulnerability classes, is not observed in any of the three evaluated frameworks. We validate these findings empirically: in a simulated government benefits agent built on LangChain, a single memory-poisoning write induces persistent targeted corruption across all tested seeds and backends, increasing the wrongful denial rate for targeted applicants to 88.9%. Under a complex five-factor policy, the same attack preserves aggregate accuracy while increasing targeted wrongful denials by 3.5x, rendering the corruption difficult to detect through standard monitoring. We then introduce two lightweight containment mechanisms: a memory integrity validator and a policy gate, which eliminate both attack vectors with sub-millisecond overhead (<0.2ms per call). We conclude that the current agentic framework ecosystem may not yet meet secure-by-default expectations for public-facing deployments and outline priority architectural interventions to enable trustworthy deployment in high-stakes, socially impactful applications.