CVE-2026-25592Disclosure

Why AI agent security becomes mandatory by the end of 2026 CVE-2026-25592 and CVE-2026-26030 Two confirmed RCEs in Semantic Kernel (SK). One prompt escalates to host-level code execution. SK is a widely deployed agent framework. If you build on it, audit tool-call permissions now. DryRun Security study: 26 of 30 agent pull requests introduced a real vulnerability. Broken access control appeared in every model tested. Claude Code, OpenAI Codex, Gemini — all of them. Shipping agent-generated code without inline scanning introduces a near-certain vulnerability. OWASP Top 10 for Agentic Applications First peer-reviewed taxonomy for agentic risk. Covers goal hijacking, tool misuse, identity abuse, and memory poisoning. Enterprise buyers will require this checklist. Architects should already be mapping to it. HashiCorp on why legacy identity and access management (IAM) breaks for agents - Agents have no login, no static role, no human session. They invoke other agents dynamically. 97% of orgs that had an AI security incident lacked dedicated AI access controls. Human-centric IAM does not port. Gravitee survey: 52% of production agents run with zero security monitoring - Only 14.4% of orgs have full IT or security approval for their agent fleet. Most deployed agents are invisible to the security team. That is not a gap. That is an open door. IBM's Agent-to-Agent Security (A2AS) framework Behaviour certificates, authenticated prompts, and defined security boundaries. IBM is positioning A2AS as the HTTPS equivalent for an agentic runtime. If it gets traction, it becomes a compliance floor. Track it.

A prompt can be a shell now. Microsoft just disclosed 2 Semantic Kernel agent bugs that can turn prompt injection into real compromise: 1) CVE-2026-26030: prompt injection → host RCE via In‑Memory Vector Store Search Plugin (default config) 2) CVE-2026-25592: arbitrary file write → full RCE (Windows Startup folder) If your agent can browse + run tools + persist memory… what’s your blast radius?

Microsoft Semantic Kernel's prompt-injection-to-RCE vulnerabilities. On May 7, Microsoft disclosed two critical bugs in Semantic Kernel, its framework for building AI agents. CVE-2026-26030 (CVSS 9.8) in the Python SDK and CVE-2026-25592 (CVSS 10.0) in the .NET SDK both turn a single crafted prompt into host-level code execution. The Python bug routed attacker-controlled vector store fields straight into eval(). The .NET bug exposed an internal file download helper as a callable kernel function with no path validation, letting a prompt-injected agent escape its sandbox by abusing DownloadFileAsync. The mechanism in both cases is the same. Functions intended for the application were registered with the LLM as tools it could call directly. Once a prompt convinced the model to call them with the wrong arguments, the model executed them with whatever privileges the application had. Prompt injection is often treated as a content problem, something to be filtered or rephrased. Once an LLM is wired to tools that touch the filesystem, the network, or a code interpreter, the prompt carries the privileges of whatever you registered. The tool registry is the attack surface. What lives in it, and how tightly its arguments are validated, decides what a successful injection can actually do. Source: https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/

@Microsoft disclosed CVE-2026-25592 and CVE-2026-26030 on May 7. Both turn prompt injection in Semantic Kernel into arbitrary file writes, RCE in the agent host. The root cause wasn't model behavior. It was a callable kernel function (DownloadFileAsync) accidentally exposed to the agent with no path validation. Agent identity isn't just "who is this agent." It's "what tools is this identity allowed to call, with what parameters." If your audit log can't answer that, you can't investigate the next one of these.

🔒 Bypassing the CVE-2026-25592 Patch in Microsoft Semantic Kernel PT ID: PT-2026-6792 The research describes a vulnerability in Microsoft Semantic Kernel (.NET SDK v1.47.0–1.48.0) and Agent Framework 1.0 that enables remote code execution (RCE). The issue stems from an unsafe trust model in which stochastic LLM output is interpreted as executable system commands. The vulnerability forms a chain of CWE-1039 → CWE-22 → CWE-94 and remains exploitable despite the official patch for CVE-2026-25592 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-25592). Exploitation requires no privileges, can be performed remotely, and may result in overwriting the host application's source code (the “Self-Nuke” vector). The research demonstrates six independent 0-day bypasses of the implemented security mechanisms. 📎 Article: https://nuka-ai.github.io/posts/2026-07-28-Semantic-Kernel-disclosure/ #dbugs_attacks

CVE-2026-25592 and CVE-2026-26030. @Microsoft Semantic Kernel. Both vulnerabilities allow prompt injection to escalate to host-level remote code execution. A crafted prompt reaches the agent, the agent processes it through Semantic Kernel, and the attacker gains code execution on the host machine. Semantic Kernel is one of the most widely deployed enterprise agent frameworks. The vulnerabilities are in the framework itself, not in any specific model. The attack surface is the execution environment. Behavioral enforcement that validates tool calls before they execute stops the escalation before the host is compromised. http://cyphrex.io #AIAgents #AISecurity #AgenticAI #LLMagents

Unpopular opinion: Most "AI agents" are just prompts duct-taped to APIs. Microsoft's Semantic Kernel AI agent framework shipped two critical vulnerabilities — CVE-2026-25592 and CVE-2026-26030 — that let an attacker convert a single malicious prompt into host-level…

Prompt injection just graduated from “annoying” to “remote shell.” Microsoft disclosed 2 critical bugs in its Semantic Kernel agent framework (May 7, 2026): 1) CVE-2026-25592 — a mis-tagged tool let an agent be tricked into writing a file anywhere (e.g., Windows Startup) → code execution on reboot. 2) CVE-2026-26030 — an InMemoryVectorStore filter used eval() on attacker-controlled data → RCE. If your agent can auto-invoke tools… your threat model is now “untrusted text == code.” What’s the first tool you’d remove from an agent in production: file-write, shell, or browser?

🔴 CVE-2026-25592 - Critical Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.70.0, an Arbitrary File Write vulnerability has been identified in Microsoft... https://www.thehackerwire.com/vulnerability/CVE-2026-25592/ https://t.co/Mgo6yCmWir

@Deep_Star_Six Are you rage-baiting? First google result: https://particula.tech/blog/semantic-kernel-cve-2026-25592-prompt-injection-rce https://t.co/9402S4slMr

What this means for your agents and systems: When Prompts Become Shells: CVE-2026-25592 & CVE-2026-26030 Prove AI Agent Frameworks Are the New OS — And They Have Root Bugs

CVE-2026-25592 · < 1.39.4 → < 1.71.0 When Prompts Become Shells: CVE-2026-25592 & CVE-2026-26030 Prove AI Agent Frameworks Are the New OS — And They Have Root Bugs

When Prompts Become Shells: CVE-2026-25592 & CVE-2026-26030 Prove AI Agent Frameworks Are the New OS — And They Have Root Bugs Microsoft disclosed two Critical CVSS 9.9 vulnerabilities in Semantic Kernel — its open-source AI agent framework with 27,000+ GitHub stars — on…

When Prompts Become Shells: CVE-2026-25592 & CVE-2026-26030 and the New Attack Surface Every AI Team Is Missing. ---

CVE-2026-25592 AI agent frameworks (Anthropic's MCP, Microsoft's Semantic Kernel, CrewAI, LangChain) have become critical infrastructure—but they're shipping with architectural flaws that turn prompts into shells and dependencies into backdoors.

The Semantic Kernel RCE vulnerabilities documented this week (CVE-2026-25592, CVE-2026-26030) illustrate the severity: a malicious prompt or tool configuration can pivot from model interaction to OS-level command execution. Organizations deploying AI agents at scale…

150 million · CVE-2026-25592 · < 1.71.0 → 1.71.0 When the Framework Is the Vulnerability: Semantic Kernel RCE, MCP's Architectural Flaw, and the Collapse of the AI Agent Trust Boundary

In the last 72 hours, researchers have disclosed critical vulnerabilities in three major agentic frameworks: CVE-2026-25592 & CVE-2026-26030 (Semantic Kernel): Prompt injection RCE CVE-2026-42302 (FastGPT): Agent runtime sandbox escape CVE-2026-44895 (GitLab MCP Server):…

CVE-2026-25592 TL;DR Agentic AI frameworks (LangChain, CrewAI, AutoGen, Semantic Kernel) have become invisible to traditional endpoint security. Your EDR logs API calls, file access, and network traffic—but not the prompts that trigger

The Audit Lag: Why Your Agentic Framework Security Posture Is 90 Days Behind Over the past six weeks, Lyrie's research has documented 17 critical vulnerabilities in agentic frameworks CVE-2026-42208, CVE-2026-44843, CVE-2026-25592, CVE-2026-26030, etc..