Microsoft Discloses Prompt-Injection-to-RCE Flaws in Semantic Kernel Agent Framework

On 7 May 2026 Microsoft's security research team published details of two critical vulnerabilities in Semantic Kernel, its open-source framework for building AI agents. The write-up, titled "When prompts become shells", describes how untrusted text reaching a model could be turned into arbitrary code execution or file writes on the machine hosting the agent, without any traditional exploit primitive.

The first issue, CVE-2026-26030, affected the Python SDK's in-memory vector store. Filter expressions were assembled through string interpolation and evaluated with Python's eval(). A blocklist was meant to keep dangerous tokens out, but researchers showed it could be bypassed by walking the class hierarchy and reaching restricted functions through alternative syntax, so a prompt-injected filter became a shell. The second, CVE-2026-25592, involved the .NET SessionsPythonPlugin, where a file-download method was exposed to the model as a callable kernel function with no path validation. A crafted prompt could write files anywhere on the host, enabling escape from a containerised sandbox. Fixes shipped in Python 1.39.4 and .NET 1.71.0, and Microsoft said upgrading requires no architectural change. Third-party trackers assigned CVSS scores of 9.8 and 10.0 respectively; the Microsoft post itself does not state scores.

The research matters beyond one framework. Microsoft flagged that the same anti-pattern, giving a language model direct access to functions that were never designed to receive adversarial input, is visible across the ecosystem, and said follow-up work covering LangChain and CrewAI would follow. Security firm research published in the same weeks reported more than ten CVEs in Model Context Protocol tooling and roughly 200,000 exposed MCP instances, reinforcing the sense that agent plumbing has become an attack surface in its own right.

For CISOs the disclosure is a clean illustration of how prompt injection, long treated as a content-safety nuisance, now sits at the top of the OWASP LLM Top 10 for a structural reason. When an agent can call tools, the model is a confused deputy: any text it reads, whether a web page, an email or a retrieved document, can carry instructions, and the blast radius is whatever the tool layer permits. The fix is not better prompts but least privilege, input validation at the tool boundary and isolation of the execution environment.

What it means for leaders

• Patch and inventory. Confirm every Semantic Kernel deployment is on Python 1.39.4+ or .NET 1.71.0+, and extend the exercise to LangChain, CrewAI, MCP servers and any home-grown tool wrappers; most organisations do not yet have agent frameworks in their software bill of materials.
• Treat tool exposure as a privilege decision. Each function a model can invoke should pass a review equivalent to granting an API key: what can it read, write or execute, and what happens if the caller is hostile?
• Isolate agent runtimes. Run tool-using agents in ephemeral, network-restricted sandboxes with no standing credentials; the file-write bug shows why a container alone is not a boundary.
• Monitor the host, not just the model. Microsoft recommends watching for unexpected child processes and anomalous behaviour from agent hosts; feed those signals into existing EDR and SIEM rather than a separate AI dashboard.
• Map to frameworks. Record these controls against OWASP LLM01 (prompt injection) and LLM06 (excessive agency), and against the NIST AI RMF "Manage" function, so audit evidence exists when regulators or customers ask.