Agent framework fatigue is real — and LangChain's latest CVE didn't help

“i’ve been using loads of ai agent frameworks (crewai, langgraph, autogen) and i just don’t get why they are so popular. i can literally do everything what they offer spending a few hours with cursor, and better.” That’s the opening line of “Sick of AI Agent Frameworks” on Hacker News — and the replies underneath it are the most useful part.

“Just barely, and definitely not up to the marketing hype”

One reply, from a commenter working in the space, cuts closer to the actual complaint than the original post does: “They work, just barely, and definitely not up to the marketing hype. I’m in the space, and it’s really hard to ‘sell’ a solution to someone who had bought the marketing bs and says ‘X said they can do Y’… Most ‘agent frameworks’ are just workflow builders with LLMs as a node in the workflow.” Another reply goes further, describing a production system with roughly 900 agents built at a law firm entirely without a framework: “If I tried to do this with these frameworks, I’d still be dinking around with their abstractions and lack of documentation.” The framing throughout the thread isn’t “frameworks are useless” so much as “the abstraction layer these tools sell often doesn’t buy you anything you couldn’t build directly against a model API.”

Then a real vulnerability showed up in the most popular one

That skepticism found a sharper edge in December 2025, when security firm Cyata disclosed CVE-2025-68664, a bug in langchain-core where — as one Hacker News commenter summarized it in the resulting 131-point, 91-comment thread — “object confusion during (de)serialization can leak secrets (and in some cases escalate further).” The commentary was pointed. One reply read: “The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.” Another simply noted, of LangChain’s creator: “Meanwhile Harrison Chase is laughing his way to the bank.”

That last line is unfair as a technical critique — plenty of widely-used open-source infrastructure has shipped CVEs — but it’s an honest snapshot of how a chunk of the developer audience currently talks about LangChain specifically: as the incumbent everyone uses and a growing number of people resent using.

What this means if you’re choosing agent infrastructure

Two real, separate signals are worth pulling apart here. First, “do I need a framework at all” is a legitimate question a meaningful slice of experienced developers are asking out loud, not a fringe take — worth actually answering for your own use case rather than defaulting to whatever’s most-starred on GitHub. Second, once you do pick a framework, its security and dependency-update track record is now a real evaluation criterion, not boilerplate due diligence. Crail’s agent frameworks category tracks LangGraph, CrewAI, LlamaIndex, and AG2 (AutoGen) side by side on exactly these dimensions, and our LlamaIndex vs. LangGraph comparison is a reasonable starting point if you’re trying to decide whether you need a full framework or something lighter.