{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/injection-reaches-code-execution/",
 "asOf": "2026-09-26",
 "id": "injection-reaches-code-execution",
 "claim": "In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.",
 "evidenceKind": "measured",
 "scope": "Affected versions of named products, some only under specific configurations (an allowlisted benign command in Gemini CLI; particular Semantic Kernel plugins exposed to the model). Most were patched after disclosure, but OX reports some MCP-related projects unpatched or rejected as by design. None is reported as exploited in the wild.",
 "topics": [
  "prompt-injection",
  "sandbox-containment"
 ],
 "atlas": [
  "sandbox",
  "tools"
 ],
 "evidence": [
  {
   "event": "gemini-cli-silent-code-execution-2025"
  },
  {
   "event": "cursor-curxecute-cve-2025-54135-2025"
  },
  {
   "event": "ox-mcp-stdio-supply-chain-advisory-2026"
  },
  {
   "event": "microsoft-semantic-kernel-prompt-to-rce-2026"
  },
  {
   "event": "cato-duneslide-cursor-sandbox-escape-2026"
  }
 ],
 "relations": [],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2025-07-28",
   "why": "Gemini CLI executed commands the approval display did not show.",
   "event": "gemini-cli-silent-code-execution-2025",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2025-08-01",
   "why": "Cursor CVE: injected content could create files that executed code.",
   "event": "cursor-curxecute-cve-2025-54135-2025",
   "kind": "evidence"
  }
 ],
 "halfLifeDays": 540,
 "wouldChange": "Frameworks that isolate tool execution from model output by default.",
 "fideQuestions": [],
 "methods": [
  "approval-bypass",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}