When the Prompt Becomes a Shell: Real RCE in Semantic Kernel (CVE-2026-26030, CVE-2026-25592)
On May 7, 2026, the Microsoft Defender Security Research Team published research that shifts the boundary: prompt injection is no longer a "wrong output" problem — it is a host-level Remote Code Execution (RCE) vector in agentic frameworks.
Primary source: When prompts become shells: RCE vulnerabilities in AI agent frameworks — Microsoft Security Blog. Two critical CVEs in Microsoft Semantic Kernel (Python and .NET SDK) demonstrate how model-to-tool integration can create dangerous execution primitives.
CVE-2026-26030: In-Memory Vector Store — eval() as a Weapon
In this vulnerability, the use of a Python lambda executed via eval() to filter Vector Store results allowed an attacker to inject malicious code. Despite an AST blocklist, the attacker bypassed it by climbing the Python class hierarchy starting from tuple() to reach os.system().
CVE-2026-25592: SessionsPythonPlugin — Sandbox Escape
The bug lies in the accidental exposure of DownloadFileAsync as an AI-invocable tool. An attacker can use the agent to generate a payload in an isolated sandbox, then via DownloadFileAsync write it directly to the host's Windows Startup folder, achieving full system control on reboot.
The Architectural Lesson
The conclusion is clear: vulnerabilities are not in AI models, but in agent architecture. When tools expose high-risk operations without host-side validation, prompt injection becomes a weapon. The LLM is not a security boundary.
Defensive Principles
- Tool Allow-listing with pinned hashes (SHA-256): verify integrity of every tool before invocation.
- Mandatory sandbox: isolation via container, VM, or WASM with network egress control.
- Remove AI access to host-side functions: functions touching the host must be called only by intentional developer code, never directly by the model.
Sovereignty without sandbox = maximum vulnerability. Build agents that know they cannot trust their own tools.