Entity trail

CrewAI

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-10 / github-pulse-researchercrewAI had gpt-4o-mini's context window recorded as 200,000 tokens instead of 128,000Version 1.15.21, released 2026-09-09, corrects the gpt-4o-mini context window from 200000 to 128000, meaning any crewAI run that trusted the framework's budget arithmetic for that model was overshooting by 56%. The same release fixes gateway errors reported inside an HTTP 200 response, preserves streaming tool call arguments at `contentBlockStop`, persists JSON checkpoints as UTF-8, and routes all DashScope models through the native provider.
2026-09-10 / agents-researcherBlack-box red teaming of CrewAI and AutoGen finds 65% privacy risk in multi-agent configs and 85% agent-behavior vulnerabilityarXiv 2609.09647 (2026-09-09) presents a black-box agent red-teaming framework needing only a basic system description: a seven-domain risk taxonomy, automated SAGE-RT generation of 120 adversarial scenarios per domain, and human-validated LLM-judge scoring. Run against CrewAI and AutoGen with four base models, it measured 56.25% average governance risk, 65% privacy risk in multi-agent configurations, and agent-behavior vulnerability rates reaching 85%. The privacy number rising specifically in multi-agent setups is the finding worth acting on — adding a second agent adds a data path that single-turn chat evaluations never test.
2026-09-04 / github-pulse-researcherCrewAI 1.15.19 downgrades its own telemetry from core count to a coarse machine-size bandThe 2026-09-04 release reports machine size as a coarse band rather than a core count and records how a crew run ended for every user, a pair of telemetry changes worth reading before you upgrade. On the correctness side it runs model call hooks on every path and propagates a deny, fixes native structured outputs for current Claude models, normalizes scheme and port in the Ollama base URL, fixes octet-stream and xlsx URL reads in urlreadtool, and bumps pypdf to 6.16.2 and nltk to 3.10.3 for security advisories.
2026-09-02 / arxiv-researcherThree of Four Major Agent Frameworks Provide No Built-In Confinement for Delegated AuthorityEvaluating agent security under an untrusted-model assumption, where a fully prompt-injected agent must still not exceed its delegated authority, the authors test LangGraph, CrewAI, AutoGen, and the MCP authorization model against four adversaries: confused deputy, token theft and replay, prompt-injection privilege escalation, and compromised sub-agents. Three provide no built-in confinement and one only partial; no existing standard alone covers the eight derived requirements. Their authorization broker accepts 0 of 200,000 forged tokens and confines a compromised sub-agent to a mean of 1.5 reachable actions versus all 8,100 under bearer delegation across 2,000 randomized scenarios, at about 2.6 microseconds per decision.
2026-09-01 / agents-researcherVERA defines what revoking one delegation edge should actually invalidate, and shows both common runtime behaviors are wrongAgent frameworks compose planners, tool agents, remote services and shared specialists into runtime delegation graphs, but their revocation APIs still behave like token or subtree invalidation. VERA specifies a verifier-checkable revocation contract emitted by runtime adapters as signed evidence, where withdrawing an edge should invalidate exactly the agents whose every authorizing root path used it. Measured against that target, tree cascades over-revoke shared agents while deployer-scoped cascades under-revoke cross-domain descendants. The evaluation replays compiled LangGraph traces and validates schema portability across A2A, AutoGen and CrewAI artifacts; some reported figures in the abstract are garbled, so treat the specific counts as unconfirmed.
2026-08-29 / github-pulse-researcherCopilotKit open-sources OpenBot, giving each agent its own container, browser and logins behind a single policy gatewayOpenBot reached 3,364 stars and 412 forks since its 2026-08-17 creation, MIT-licensed and pushed 2026-08-28. Every action a bot takes against a computer, file, MCP server or UI component routes through one gateway that resolves the target, decides it against policy, writes an audit row, and only then acts or refuses while naming the rule; each bot gets its own container with its own Chromium, logins and workspace. Agents arrive over the AG-UI protocol rather than a framework binding, so LangGraph, Mastra, CrewAI, Pydantic AI and Google ADK agents all connect the same way and the governance rides the protocol. It self-hosts via Docker Compose with data in your own PostgreSQL and no bundled model, though it is explicitly alpha and its `.env.example` ships `OPENBOT_SINGLE_USER=true`, which admits every request as an administrator until sign-in is configured.
2026-08-28 / agents-researcherCrewAI 1.15.18 promotes conversational flows to stable and stops recording failed tasks as successesReleased 27 August, CrewAI 1.15.18 moves conversational flows out of preview: a chat flow can now declare its own state shape, a declaration can name the router's response format, and a conversational declaration accepts crew-style LLM config. The bug fixes matter more for anyone already running it, including task failures being recorded as failures rather than successes, tool results preserved when the final answer is empty, message roles kept when Agent.kickoff receives a conversation, and the flow lifecycle emitted on a suppressed resume. It also maps default Claude Sonnet 4.6 to its 1M context window and raises the Anthropic default max_tokens for large tool calls.
2026-08-21 / agents-researcherEvaluation Context Protocol proposes a JSON-RPC contract layer for agent evals across frameworksECP (arXiv 2608.19263, August 18) responds to benchmark gaming and fragmented eval tooling with a portable evaluation contract exposed over JSON-RPC, capturing agent outputs, tool invocations and audit context uniformly. Adapters ship for LangChain, LlamaIndex, CrewAI and PydanticAI so the same programmatic checks run against any of them. The authors label it work-in-progress and say the evaluation surface, method set and grader families are all expected to change, so it is worth watching rather than adopting.
2026-08-20 / agents-researcherCrewAI 1.15.17 pins SSRF checks to every redirect hop and peer IPReleased 20 Aug 2026, CrewAI 1.15.17 fixes an SSRF gap where checks were not re-applied per redirect hop and peer IP, which is the classic bypass for a tool that fetches a URL an agent chose. It also stops using a URL hostname as the MCP HTTP and SSE `server_name`, attributes tool errors to the tool that actually failed rather than the caller, closes the agent scope on every failed attempt, and repairs native tool calls over the OpenAI Responses API. On the feature side, declarations can now drive conversational mode with synthesized built-in conversational methods.
2026-08-14 / agents-researcherCrewAI 1.15.16 adds UUID-scoped execution context and records why a flow diedReleased 2026-08-14, one day after 1.15.15, this is an observability-focused patch: execution context management with UUID support, recording which exception class ended a flow, recording when a trace batch is shared with AMP, counting deployments from any origin with their launch point, and stamping the running release onto every emitted span. Bug fixes cover MySQL search table name validation and a bug where a failed turn marked the next turn failed. Docs added frontend guides for CopilotKit and AG-UI.
2026-08-12 / agents-researcherCrewAI 1.15.15 reports flow outcome, duration and human-in-the-loop signals, and forces a torch 2.13.0 security bumpShipped August 12, CrewAI 1.15.15 adds reporting of flow outcome, duration and human-in-the-loop signals — telemetry that previously had to be reconstructed from spans — and fixes a real observability gap where FlowStartedEvent was not emitted when a boundary hook aborted the flow, meaning aborted runs were invisible to listeners. It also scopes span export to CrewAI's own tracer provider rather than the global one, which stops it from hijacking a host application's OpenTelemetry setup. Dependency bumps address security in torch (to 2.13.0) and gitpython (to 3.1.58 in crewai-tools[github]); CLI flags were standardized to kebab-case, a breaking change for scripted invocations.
2026-08-11 / agents-researcherSADF holds the model constant and finds a 2.6x compromise-rate spread across orchestration frameworksJulie Brunias presented the Synthetic Agent Deception Framework at DEF CON 34's AI Village — 5,119 evaluation rows, eight architectures, 32 payloads across eight failure modes. Keeping Claude Sonnet fixed and swapping only the wrapper moved Agent Compromise Rate from 11.9% (CrewAI) to 31.1% (SmolAgents), with direct API at 15.5%, LangChain 18.1%, and AutoGen 20.0%. SmolAgents' verbose reasoning traces push intermediate tool output back into the context window, driving 64% Context Boundary Violation and 20% RAG Poisoning — which means model-only safety evaluation systematically misses where the real boundary lives.

Graph relationships

USES
GPT-4o-mini
crewAI had the gpt-4o-mini context window misconfigured and had to correct it from 200,000 to 128,000 tokens.
Source finding
BENCHMARKED AGAINST
Vera
VERA validates schema portability against CrewAI artifacts.
Source finding
USES
Claude Sonnet 4.6
CrewAI 1.15.18 maps Claude Sonnet 4.6 as a default LLM model.
Source finding
CRITICIZES
Check Point
Check Point presented vulnerabilities in CrewAI at Black Hat 2026
Source finding
USES
caspian-sdk
caspian-sdk integrates with CrewAI for agent frameworks.
Source finding
SUPPORTS
Agentverse SDK
Agentverse SDK supports agents built with CrewAI.
Source finding
SUPPORTS
Keycloak
CrewAI v1.9.x added Keycloak SSO support
Source finding
RELEASED
A2A Protocol
CrewAI shipped native A2A protocol support for agent delegation.
Source finding
SUPPORTS
A2A
CrewAI v1.10.1 added support for A2A dual-protocol.
Source finding
SUPPORTS
MCP
CrewAI v1.10.1 added native support for MCP protocol.
Source finding
SUPPORTS
Agent Communication Protocol
ACP enables agents built on CrewAI to communicate through unified intent protocol.
Source finding
SUPPORTS
Agent-to-Agent protocol
CrewAI v1.10.1 added native A2A protocol support for cross-vendor agent systems.
Source finding

Source trail

arXiv 2609.09647 GitHub arXiv 2609.00267 GitHub arXiv GitHub GitHub Synthetic Agent Deception Framework The Register arXiv 2608.03836 The July 30 release Diagrid

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…