Microsoft researchers found a path in Semantic Kernel where a single prompt could turn prompt injection into host-level remote code execution — code running on the device hosting the AI agent.
Autonomous agents that can run tools or code dramatically raise the impact of any injection.
Our analysis
This is the moment prompt injection stopped being a “content” problem and became an infrastructure problem. When an agent framework can be coerced into running code on the host, the impact is textbook RCE — the same class of bug we chase in classic applications, now reachable through natural language. Any agent that can touch a shell, an eval, or a code interpreter should be assumed to be one clever prompt away from arbitrary execution.
What you should do
- Run agents inside strong sandboxes or containers with no host access and minimal capabilities.
- Never pass model output directly into shells,
eval, or code interpreters without strict validation. - Keep agent frameworks patched and track security advisories for Semantic Kernel, LangChain and similar.
- Threat-model the agent before you build it to remove code-execution paths by design.
How AgentOffense helps: our AI agent penetration testing and LLM application penetration testing hunt tool-abuse and sandbox-escape chains end to end.
Source: Microsoft Security Blog.