Composite Security Score
58/100
"The bar is low, but CrewAI clears it. One critical vulnerability, patched in 5 hours. Enterprise features that actually exist. The first agent framework we've reviewed that isn't on fire."
150+
Enterprise Customers
What is CrewAI?
CrewAI is an open-source multi-agent orchestration framework that lets developers build teams of AI agents that collaborate on complex tasks. Founded in 2024 by João Moura, the company raised $24.5M and counts PwC, IBM, Capgemini, and NVIDIA among its enterprise customers.
The framework powers 1.4 billion agentic automations globally, with approximately 450 million agent executions per month. Over 100,000 developers have completed CrewAI certification courses. Unlike OpenClaw, CrewAI offers both an open-source framework and an enterprise platform (CrewAI AMP) with additional security features.
On March 5, 2025, Noma Labs discovered a critical vulnerability in CrewAI's platform. During machine provisioning failures, error responses inadvertently exposed an internal GitHub token with full administrative privileges.
Vulnerability Details
CVSS Score
9.2 (Critical)
What Was Exposed
GitHub Admin Token
Time to Patch
5 hours
Known Exploitation
None
Potential Impact
- Complete access to all private GitHub repositories
- Ability to inject malicious code into production releases
- Harvesting of embedded secrets and API keys
- Supply chain attacks affecting downstream users
Source: Noma Security — "Uncrew: Understanding the Risk Behind a Leaked Internal GitHub Token", March 2025
Unit 42 Agentic AI Threat Research
Palo Alto Networks' Unit 42 tested CrewAI (and AutoGen) against nine attack scenarios. Their critical finding: vulnerabilities are framework-agnostic, arising from design patterns rather than framework flaws.
| Attack Type |
Result |
| Prompt Extraction |
Successful |
| Tool Schema Disclosure |
Successful |
| Credential Leakage |
Successful |
| SQL Injection via Tools |
Successful |
| BOLA (Cross-User Access) |
Successful |
"Neither CrewAI nor AutoGen are inherently vulnerable. The attack scenarios highlight systemic risks rooted in language models' limitation in resisting prompt injection and misconfigurations or vulnerabilities in the integrated tools."
— Palo Alto Networks Unit 42, January 2026
MCP Security Warnings
CrewAI's own documentation explicitly warns about Model Context Protocol (MCP) integration risks. To their credit, they document these dangers clearly — but the attack surface remains significant.
Prompt Injection via Metadata
"This attack can occur simply by connecting to a malicious server and listing its tools, even if your agent never explicitly decides to use any." Just listing tools from an untrusted MCP server can compromise agent behavior.
Arbitrary Code Execution
Malicious MCP servers can run code on your system, particularly through Stdio transport for local servers.
DNS Rebinding & Token Mishandling
Remote connections are vulnerable to DNS rebinding attacks. OAuth proxy patterns can enable "confused deputy" attacks.
Source: CrewAI Documentation — MCP Security Considerations
Security Features That Actually Exist
Unlike some frameworks we've reviewed, CrewAI has implemented real security infrastructure for enterprise deployments.
Docker-Based Sandboxing
Code Interpreter Tool executes in Docker containers when using "safe" mode. Recommended for all production deployments.
Role-Based Access Control (RBAC)
Enterprise tier includes granular permissions for tools, crews, and data. Private tool repositories require explicit access grants.
On-Premise Deployment Option
CrewAI AMP can be deployed on-premise for organizations with strict compliance requirements.
AgentOps Integration
Built-in prompt injection detection and observability tooling through AgentOps integration.
What's Still Missing
No Public Security Audit
Unlike many enterprise tools, no third-party penetration test results have been published. We know about the Uncrew incident because Noma Labs disclosed it — not because CrewAI shared it proactively.
No Bug Bounty Program
Security researchers have no financial incentive to report vulnerabilities. Rewards are "at CrewAI's discretion."
Prompt Injection Remains Unsolved
This is an industry-wide problem, not CrewAI-specific. But Unit 42 demonstrated successful prompt extraction and behavioral manipulation against CrewAI deployments.
The Question That Matters
CrewAI represents what "pretty good" looks like in agent security today. They responded to a critical vulnerability in 5 hours. They document security risks honestly. They offer real enterprise features like RBAC and sandboxing. But the bar is extraordinarily low. "Pretty good" still means your agents can be prompt-injected, your tool schemas can be leaked, and connecting to the wrong MCP server can compromise your entire system. CrewAI isn't the problem — the problem is that this is the best we've got.
Would I Deploy This in Production?
CONDITIONALLY YES
CrewAI Enterprise with Docker sandboxing, RBAC enabled, and careful MCP server vetting is deployable. The open-source version without these controls? Only for prototyping. This is the first agent framework we've reviewed that has a credible path to secure deployment — but you have to take that path deliberately.