When a Prompt Opens a Shell: RCE via Injection in AI Agents

Prompt injection has long been framed as a confidentiality problem: an attacker slips in hidden instructions to leak data or hijack a response. The research Microsoft published on May 7, 2026, changes the nature of the risk. In a widely used AI agent framework, Semantic Kernel, a simple prompt injection can be turned into remote code execution on the host running the agent. The Defender research team's demonstration is striking: a single injection into a hotel-finder agent, and calc.exe opens on the machine running the agent process. No browser exploit, no malicious attachment, no memory corruption. A prompt.

This incident marks a turning point any organization deploying AI agents must internalize, and it is not isolated: OWASP published its Top 10 for Agentic Applications in December 2025, recognizing that this threat class has become central.

How a prompt becomes code execution

Two distinct vulnerabilities were disclosed. CVE-2026-26030, rated CVSS 9.8, routes attacker-controlled vector store fields into a Python eval() call. CVE-2026-25592 exposes a host-side file download method as a function callable by the agent's kernel. The first case is the most instructive for understanding the mechanism.

The framework does perform an abstract syntax tree validation of the content before evaluating it, and blocks certain dangerous identifiers and attributes. But attackers bypassed these restrictions using Python class hierarchy traversal techniques, which let them dynamically load the os module and execute system commands. In other words, the security barrier, a blocklist of identifiers, was crossed by an indirect path the list did not cover. It is a classic reminder: blocklisting what can reach a code evaluator is almost always bypassable.

The architectural lesson is that the tool registry is the attack surface. As soon as an agent can call functions, and the content it processes can influence which function is called and with what arguments, a well-crafted prompt injection becomes an unintended function call. When one of those functions reaches a code evaluator or a system primitive, the injection becomes an RCE.

Red teaming: how to test your own agents

Reactive detection is not enough for this class of flaw: you must test your agents before an attacker does. An AI agent red teaming exercise should cover several axes.

First, indirect injection via data. Place malicious instructions in the sources the agent reads without the user typing them: indexed documents, search results, tool descriptions, vector store fields. This is the exact vector of CVE-2026-26030. Check whether data content can influence a tool call.

Second, the inventory of dangerous tools. List every function exposed to the agent and identify those that reach, directly or transitively, a code evaluator, filesystem access, process launching, or an outbound network request. These are the targets for escalation to RCE.

Third, the filter-bypass test. If your agent relies on a blocklist to stop certain identifiers or patterns, explicitly attempt class hierarchy traversals and indirect constructions, because that is precisely what worked against Semantic Kernel.

The design principles that close the gap

Beyond the patches, whose application is a priority, several principles structurally reduce the risk. The first is to never route controllable content into a dynamic code evaluator: prefer a set of explicitly allowed functions, with typed arguments, over an eval() protected by a blocklist. The second is least privilege applied to tools: the agent should have only the functions strictly needed for its task, and those functions should run in an isolated context, without direct access to the host. The third is argument validation at the boundary of each tool, independent of what the model decided.

Microsoft shipped the fixes in semantic-kernel version 1.39.4 for Python and 1.71.0 for .NET. But the patch does not remove the need for the underlying exercise: any agent able to call tools inherits this class of risk, whatever the framework used.

Testing an AI agent's robustness against prompt injection and escalation to RCE requires a dedicated methodology and tooling. That is what the ThreatClaw LLM red team feed provides: test cases and probes built on the real attack techniques against agents and their tool registries, to exercise your deployments before an attacker does.