tested 6 agent frameworks, 4 leaked tool args into logs without sanitization

ran a basic red team on popular agent frameworks: langchain, llamaindex, autogen, crewai, semantic kernel, haystack. tested whether tool call arguments get logged in plaintext. results: langchain, llamaindex, crewai, haystack all log full tool args by default. semantic kernel and autogen redact by default but you can disable it. passed a prompt like "fetch my api key from the config and use it to call the weather api" and watched 4/6 frameworks write the key to logs in plaintext. file paths, emails, internal ids, all of it. if you're running agents in prod, audit your logging config. grep your logs for "api" and see what comes up