Researcher Yarden Porat of Cyata disclosed four vulnerabilities in CrewAI, an open-source Python framework for building multi-agent AI systems, led by CVE-2026-2275 (CVSS 9.6). An attacker who can reach an agent configured with CrewAI’s Code Interpreter tool can use prompt injection to trigger an insecure sandbox fallback, escape it, and execute arbitrary code on the host or read its files; three related flaws (CVE-2026-2286, CVE-2026-2287, CVE-2026-2285) stem from additional insecure default configurations in the same toolchain. A public proof-of-concept exists, but no confirmed real-world exploitation has been reported, and CrewAI’s maintainers were still working on a complete fix as of the disclosure.