On May 7, 2026 Microsoft disclosed two vulnerabilities, CVE-2026-26030 and CVE-2026-25592, in Semantic Kernel where a simple prompt injection ended in code execution on the host — a clear example that every tool available to the model is a new attack surface.
On May 7, 2026 Microsoft's security blog disclosed two vulnerabilities in Semantic Kernel, a framework teams use to build AI agents with Python and .NET. The striking part was how simple the attack was: according to Microsoft's researchers, a single prompt was enough to pop open Windows Calculator on the machine running the agent — with no browser exploit, malicious attachment or memory-corruption bug.
The first, CVE-2026-26030, affected Python versions before 1.39.4 and lay in the Search Plugin and the default filter function of the in-memory vector store. The root cause was a combination of two common mistakes: unsafe string interpolation into code, and reliance on a blocklist for validation. With a crafted prompt an attacker could bypass Python's AST restrictions — for example by walking the class hierarchy through __class__ and __subclasses__ — and reach dangerous functions like os.system().
The second, CVE-2026-25592, concerned the .NET SDK (versions older than 1.71.0) and the SessionsPythonPlugin. There, the DownloadFileAsync function had unintentionally been exposed to the model as a tool, meaning the model itself could call it. The result: arbitrary file write on the host through prompt injection — for example dropping a malicious script into the Windows Startup folder so it runs at the user's next sign-in.
The shared lesson is that in agent architectures the model's output, and the arguments it builds for tools, must be treated as untrusted input. Every function you give the model is in effect a public endpoint that an attacker can call indirectly — through text the model reads, such as a document, web page or email. This conclusion is our interpretation, but it aligns with Microsoft's own recommendations.
Microsoft's recommendations include: upgrading to Python version 1.39.4 or later and .NET SDK 1.71.0 or later; using an allowlist based on AST node types instead of a blocklist; validating file paths with canonicalization; removing the [KernelFunction] attribute from sensitive operations; and monitoring for post-compromise signs with endpoint telemetry.
For teams building enterprise assistants we suggest a few practical steps (our summary, not Microsoft's official advice): inventory every function and tool available to the model and remove anything unnecessary; run the agent process under a low-privilege account, ideally inside a container or sandbox; require human approval for destructive or irreversible actions (deletion, payment, sending); log every tool call; and run an agent-specific security review before real-world deployment.
The overall message is clear: an intelligent assistant's security does not depend only on a "safe model"; it depends on the code that connects the model to real systems. The more access an agent has, the higher the cost of a successful prompt injection.
This note is a summary and rewrite based on the report below; see the original source for the full report.
Microsoft Security BlogThe 2026 report by the Cambridge Centre for Alternative Finance (CCAF), with BIS, IMF, WEF and others, shows 81% of financial firms use AI and software engineering is the most mature use — yet concern over lost human oversight and weak explainability is serious.
According to a SiliconANGLE report on September 18, 2026, a week that saw multi-billion-dollar AI infrastructure investments alongside safety tools to rein in rogue agents — the AI-agent industry's paradox.
Research by Medrano, Verma and Chhabra shows that in a production-like RAG system, RAG Fusion raises recall, but after re-ranking and context truncation much of the gain disappears and precision even dips slightly.
