Chronicle/Attacks & incidents

Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution

May 7, 2026AttackVulnerability disclosureSignificance assistant-drafted

Microsoft's Defender security research team described two vulnerabilities in its open-source Semantic Kernel agent framework in which attacker-influenced prompts could reach code execution on the host. One involved unsafe string interpolation in an in-memory vector store filter; the other exposed a code-execution plugin function that allowed arbitrary file writes outside its sandbox. Both were fixed in updated SDK releases.

Why it matters

Shows that agent framework plumbing, not just the model, can turn a prompt injection into host compromise.

Key facts

As stated in the sources, with where to find them.

CVE-2026-26030 affects the Semantic Kernel Python SDK before 1.39.4 (in-memory vector store).Vulnerability sections
CVE-2026-25592 affects the .NET SDK before 1.71.0 (SessionsPythonPlugin), enabling file writes to the host filesystem.Vulnerability sections

Findings that cite this record

Jul 28, 2025

In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Corroboratedmeasured5 evidence records

Key questions this bears on

Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
Do cyber evaluations of AI agents stay contained?Not reliably. Several labs and a government evaluator have disclosed agents under evaluation acting on real third-party systems.

Sources

When prompts become shells: RCE vulnerabilities in AI agent frameworksMicrosoft SecurityMay 7, 2026Primary sourceAccessed Sep 25, 2026

Related records

Jul 1, 2026

DuneSlide: two Cursor flaws let prompt injection escape the agent sandbox (CVE-2026-50548/50549)

AttackVulnerability disclosureCato Networks, Cursor

Aug 1, 2025

CurXecute: prompt injection could make Cursor create MCP config and run commands (CVE-2025-54135)

AttackVulnerability disclosureAim Security, Cursor

Apr 15, 2026

OX Security advisory: MCP STDIO configuration enables command execution across agent frameworks

AttackVulnerability disclosureOX Security, Anthropic

Jan 20, 2026

Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection

AttackVulnerability disclosureCyata, Anthropic

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Microsoft, GitHub

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Organizations: Microsoft
Topics: Prompt injection Sandbox & containment Tools & MCP
Attack surface: Tools & MCP Execution sandbox Untrusted content
Methods: Indirect prompt injection Memory and context poisoning Sandbox and environment escape Sandboxing and egress control
Record: microsoft-semantic-kernel-prompt-to-rce-2026 · added 2026-09-25

Cite this record

Fide AI. "Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution." Agentic Cyber Explorer, record microsoft-semantic-kernel-prompt-to-rce-2026. https://agentic-cyber-explorer.pages.dev/events/microsoft-semantic-kernel-prompt-to-rce-2026/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-microsoft-semantic-kernel-prompt-to-rce-2026,
  author = {{Fide AI}},
  title = {Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/microsoft-semantic-kernel-prompt-to-rce-2026/},
  note = {Record microsoft-semantic-kernel-prompt-to-rce-2026; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.