← Back to feed
2026-05-26 Prompt InjectionMalicious ToolMcp Security TLP:CLEAR

Microsoft Semantic Kernel Remote Code Execution: Prompt Injection to Python Eval Sink in AI Agent Frameworks

Date: 2026-05-26
Tags: prompt-injection, malicious-tool, mcp-security

Executive Summary

Microsoft disclosed two critical vulnerabilities in Semantic Kernel, an open-source framework for building AI agents with over 27,000 GitHub stars, that allow attackers to cross from prompt injection to code execution primitives. CVE-2026-26030 affects Python package semantic-kernel prior to version 1.39.4, particularly when using the In-Memory Vector Store with filter functionality. Upgrading to version 1.39.4 or higher mitigates the risk.

Campaign Summary

FieldDetail
Campaign / MalwareSemantic Kernel RCE Exploitation Chain
AttributionUnknown - disclosure only, no documented exploitation (confidence: none)
TargetOrganizations deploying Microsoft Semantic Kernel framework in AI agent applications
VectorPrompt injection targeting unsafe vector store filter operations leading to arbitrary Python code execution via eval()
Statusactive
First Observed2026-05-07

Detailed Findings

Once an AI model is wired to tools, prompt injection draws a thin line between being just a content security problem and becoming a code execution primitive. The LLM is not a security boundary; the tools exposed define the attacker's affected scope, and any tool parameter the model can influence must be treated as attacker-controlled input. Defending AI agents requires acknowledging that AI models aren't security boundaries; security teams must correlate signals across two layers: the AI model level (intent detection through meta prompts and content safety filters) and the host level (execution detection), with traditional endpoint defense detecting anomalous behavior such as an AI agent process spawning command lines or dropping scripts into Startup folders.

MITRE ATT&CK Mapping

TechniqueIDContext
Prompt InjectionT1059Attacker crafts malicious prompts that bypass LLM guardrails and influence tool parameters
Code ExecutionT1059.006Unsafe eval() in vector store filter allows arbitrary Python AST traversal and execution

IOCs

Domains

_Vulnerable versions: Python semantic-kernel < 1.39.4; .NET SDK < 1.71.0. No IOCs published for exploitation in the wild._

Full URL Paths

_Vulnerable versions: Python semantic-kernel < 1.39.4; .NET SDK < 1.71.0. No IOCs published for exploitation in the wild._

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

semantic-kernel

Detection Recommendations

Defenders should define the vulnerable window from the moment a vulnerable Semantic Kernel version was deployed until version 1.39.4 or later was installed, and focus investigation on that time range. Monitor for: (1) Python processes spawning eval() with untrusted input; (2) Semantic Kernel framework versions < 1.39.4 or .NET SDK < 1.71.0 in production; (3) Unusual AST traversal patterns in application logs; (4) Unexpected subprocess execution from AI agent processes.

References