Microsoft researchers show how prompt injection turns AI agents into remote code execution

In a research post published May 7, 2026, Microsoft's Defender Security Research Team described how vulnerabilities in AI agent frameworks can turn a prompt — ordinarily just text fed to a language model — into a functioning shell for an attacker, using Semantic Kernel, Microsoft's own open-source agent orchestration framework, as a case study. The post detailed two specific flaws: CVE-2026-26030 in the InMemoryVectorStore's filter functionality and CVE-2026-25592, reachable through the SessionsPythonPlugin and general AI agent function calling in the .NET SDK.

GitHub's security advisory for CVE-2026-26030 describes it as a critical remote code execution vulnerability in the Semantic Kernel Python SDK's InMemoryVectorStore filter functionality, affecting versions before 1.39.4 and fixed in that release. NVD's entry assigns the flaw a CVSS 3.1 score of 9.9, in the critical range. The companion flaw, CVE-2026-25592, is described by GitHub's advisory database as an arbitrary file write via AI agent function calling in the .NET SDK, affecting Microsoft.SemanticKernel.Core versions before 1.71.0 and the Python SDK before 1.39.3, both since patched.

Why it matters

Prompt injection has generally been discussed as a way to make an AI system misbehave — leak data it shouldn't, follow instructions it shouldn't, or produce harmful output. These two vulnerabilities show a more consequential escalation path: when an agent framework gives a language model the ability to call functions, write files, or query a vector database, a successful injection is no longer limited to manipulating the model's output — it can become full remote code execution or arbitrary file write on the host running the agent.

Semantic Kernel is used to build production AI agents that call tools, access data stores and take real actions, meaning any application built on a vulnerable version inherited an RCE-class bug in its most privileged software component before the patch shipped. Because prompt injection can come from untrusted content an agent reads, not just direct user input, these vulnerabilities apply even to systems whose designers assumed their end users were trusted.

How it works

Microsoft's post lays out the general attack chain: an attacker delivers a prompt injection — potentially through content the agent retrieves rather than direct conversation with a user — that manipulates the agent into calling a vulnerable framework function with attacker-controlled parameters. For CVE-2026-26030, GitHub's advisory specifies the vulnerable path runs through the InMemoryVectorStore's filter functionality in the Python SDK. For CVE-2026-25592, the path runs through the SessionsPythonPlugin and general AI agent function calling, allowing an attacker to write arbitrary files via the .NET SDK. This report does not reproduce the specific payloads or injection strings involved.

Evidence

Both CVEs are documented in Microsoft's own advisory posts and the associated GitHub Security Advisories, GHSA-xjw9-4gw8-4rqx and GHSA-2ww3-72rp-wpp4, which list exact affected and patched version ranges. NVD's entry for CVE-2026-26030 independently confirms the description and remediation guidance, noting the fix shipped in python-1.39.4 and recommending, as a workaround for those unable to upgrade, avoiding the vulnerable filter functionality. Microsoft's Security Blog post, authored by its own Defender Security Research Team, situates both CVEs within a broader case study of RCE vulnerabilities across AI agent frameworks.

What defenders should do

Organizations using Semantic Kernel should confirm they are on Python SDK 1.39.4 or later and .NET SDK Microsoft.SemanticKernel.Core 1.71.0 or later, since both CVEs are already patched. More broadly, teams building AI agents with tool-calling or code-execution capabilities should apply the same least-privilege discipline they would to any other privileged service: sandbox agent execution environments, restrict what file paths and system calls an agent's tools can reach, and treat any content an agent retrieves from an untrusted source — documents, web pages, tool outputs — as potentially adversarial input capable of steering the agent's next action.

What happens next

Researchers across the industry, including work presented at the 2026 USENIX Security Symposium on indirect prompt injection in the wild, are actively cataloguing this same escalation pattern across other agent frameworks, not just Semantic Kernel. The OWASP GenAI Security Project's 2026 top-ten list for large language model applications continues to rank prompt injection as its top risk category, reflecting an expectation that similar framework-level escalation bugs will keep surfacing as more products ship AI agents with real-world tool access.