In brief
AI agents don't just chat. They search databases, open files and run code through "tools" their developers connect. Microsoft's security researchers showed what happens when that connection trusts the AI too much: in a test agent built with Microsoft's own Semantic Kernel framework, a single prompt was enough to launch a program on the machine. Microsoft has fixed both flaws it found. The lesson is bigger than one framework.
What happened?
Microsoft found and disclosed two critical vulnerabilities, CVE-2026-25592 and CVE-2026-26030, in Semantic Kernel, an open-source toolkit for building agents. One let an attacker run code through a search feature. The other allowed arbitrary file writes through a Python plugin.
How a hotel search became a shell
The researchers built a simple hotel finder agent. You ask for hotels in Paris; the AI calls a search tool with the city "Paris".
Behind the scenes, that search built a small filter out of text and ran it as Python, using eval(). The city name went straight into that text. So a carefully written message could make the AI pass a "city" that closed the quote and added instructions of its own. The framework did have a blocklist of dangerous words. The researchers found a way around it, because blocklists in dynamic languages like Python are inherently fragile.
The key point
Microsoft is clear that the AI model wasn't broken. It did what models do: turn language into tool calls. The flaw lies in how the framework and tools trust the parsed data.
Our reading: this is the oldest bug in software, injection, wearing new clothes. Anything an AI model produces should be treated like input typed by a stranger, because with prompt injection, it may be.
What is confirmed?
- Microsoft found and disclosed two critical flaws, now fixed.
- The search flaw ran filter code using eval().
- The fix uses an allowlist that permits only safe constructs.
What remains unknown?
- Whether attackers used either flaw before the fixes. Microsoft's post doesn't report any.
- Which other agent frameworks have similar flaws. Microsoft says this is the first post in a series.
Why it matters
Agents are being wired into email, files and business systems. If model output can reach code that runs, every document an agent reads becomes a possible attack.
Who is affected?
For the search flaw, the attacker must have a prompt injection vector, meaning some way to get text in front of the agent: a chat box, an email it reads, a web page it browses. Python agents on versions before 1.39.4 using the affected search setup are vulnerable. Microsoft's fix replaced the blocklist with an allowlist that permits only safe constructs.
What readers should do
- Update Semantic Kernel to a fixed release, and check which plugins your agents load.
- Never build code from model output. If a tool takes parameters, validate them as data with strict types, not as text to execute.
- Prefer allowlists to blocklists. List what is allowed; everything else fails.
- Assume prompt injection will happen. Give agents the smallest set of tools and permissions the job needs, and run tool code in a sandbox.
- Log every tool call, so you can see what an agent actually did.