Defender’s Cleanup Path Becomes the Attack Surface
A security stack is only defensive until its own cleanup path can be bent into control. Check Point’s research shows Windows Defender’s undocumented kernel cleanup driver can run Ring 0 file and registry operations from encrypted instructions, so a fully patched machine can still have Defender itself removed once an attacker learns its format.
The finding spans 18 signed builds from Windows 7 through Windows 11 25H2, and every build used the same hard-coded key. In the same Black Hat session, Check Point showed the same pattern in AI agent frameworks: content that looks like normal data can be reinterpreted by framework plumbing such as serializers, caches, and file parsers, with findings across LangChain, Google ADK, Microsoft Agent Framework, and CrewAI.
The common risk is a trust boundary that sits below the obvious control plane. In Windows, the problem is not a missing patch on an endpoint, but a privileged component that was never meant to be treated as hostile input. In agent systems, the break is not the prompt itself, but the framework internals that can turn attacker-controlled content into state or actions.