Microsoft researchers found a path in Semantic Kernel where a single prompt could turn prompt injection into host-level remote code execution — code running on the device hosting the AI agent.
Autonomous agents that can run tools or code dramatically raise the impact of any injection.
Our analysis
This is the moment prompt injection stopped being a “content” problem and became an infrastructure problem. When an agent framework can be coerced into running code on the host, the impact is textbook RCE — the same class of bug we chase in classic applications, now reachable through natural language. Any agent that can touch a shell, an eval, or a code interpreter should be assumed to be one clever prompt away from arbitrary execution.
What you should do
- Run agents inside strong sandboxes or containers with no host access and minimal capabilities.
- Never pass model output directly into shells,
eval, or code interpreters without strict validation. - Keep agent frameworks patched and track security advisories for Semantic Kernel, LangChain and similar.
- Threat-model the agent before you build it to remove code-execution paths by design.
How AgentOffense helps: our AI agent penetration testing and LLM application penetration testing hunt tool-abuse and sandbox-escape chains end to end.
Source: Microsoft Security Blog.
How prompt injection escalates to code execution
The jump from ‘the model said something bad’ to ‘the attacker ran code’ happens when a framework turns model output into an action without validation — passing it to a code interpreter, a shell, an eval, or a database query. Prompt injection sets the model’s output; the framework faithfully executes it.
It is the AI-era version of a classic injection flaw, and the fix is the same discipline: never trust output, sandbox execution, and keep authorisation in your own code. See how to secure an AI agent.
What this means for your business
When prompt injection escalates to remote code execution, the AI layer stops being a content-safety issue and becomes classic RCE with a new entry point. Any framework that turns model output into actions or code is exposed.
How to reduce your exposure
- Never pass model output directly into a shell, query or eval — validate and constrain it.
- Sandbox any code or tool the model can invoke, with no standing privileges.
- Enforce authorisation in your own code, outside the model.
- Test the full path from injected prompt to action.
Test your AI framework end to end with AI agent penetration testing and prompt injection testing — get a fixed-price quote.