Microsoft researchers found a path in Semantic Kernel where a single prompt could become host-level remote code execution — code running on the machine hosting the AI agent.
Our analysis
This is the point where prompt injection stopped being a content problem and became an infrastructure one. If an agent framework can be talked into running code, the impact is classic RCE — reachable through plain language. Any Cyprus team giving an agent access to a shell, an interpreter or code execution should assume it’s one clever prompt from compromise.
What you should do
- Run agents in strong sandboxes with no host access and minimal capabilities.
- Never pass model output straight into shells, eval or code interpreters.
- Keep agent frameworks patched and track their security advisories.
- Threat-model the agent before build to design code-execution paths out.
How CyprusPentest helps: our AI agent penetration testing and agentic AI threat modeling hunt tool-abuse and sandbox-escape chains.
Source: Microsoft Security Blog.