In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Affected versions of named products, some only under specific configurations (an allowlisted benign command in Gemini CLI; particular Semantic Kernel plugins exposed to the model). Most were patched after disclosure, but OX reports some MCP-related projects unpatched or rejected as by design. None is reported as exploited in the wild.