Microsoft's demonstration used a hotel-finder agent. The model selected a search tool and supplied a city parameter. In the affected implementation, that parameter was interpolated into a Python lambda expression that was later executed with eval(). The framework had an AST validator, so exploitation was not simply a direct call to eval with arbitrary…
Inspect the ClaimsCase · DiggingBeagle record
Semantic Kernel prompt injection reached host code execution
CVE-2026-26030 allowed a model-controlled Search Plugin parameter to reach an unsafe eval-based filter path and execute code on the Semantic Kernel host under affected conditions.
Scope
Semantic Kernel Python versions before 1.39.4 when an agent exposes the Search Plugin backed by the vulnerable In-Memory Vector Store filter functionality and an attacker can influence the agent input.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The recorded Microsoft AST bypass demonstration and maintainer version advisory establish the configured Search Plugin/eval path and patch availability; no broad in-the-wild exploitation is established. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-RCE · CLM-BYPASS · CLM-AFFECTED · CLM-EVAL-SINK · Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution · When prompts become shells: RCE vulnerabilities in AI agent frameworks
At a glance
Treat model-controlled tool parameters as attacker-controlled input. Patch the framework, remove unsafe dynamic evaluation paths, and investigate the vulnerable deployment window for host-level indicators rather than assuming a model refusal would have prevented exploitation.
Read the implicationsThe cited sources do not establish widespread exploitation in the wild. Exposure depends on the specific Search Plugin and In-Memory Vector Store configuration.
Limits and uncertaintyFull account
Microsoft's demonstration used a hotel-finder agent. The model selected a search tool and supplied a city parameter. In the affected implementation, that parameter was interpolated into a Python lambda expression that was later executed with eval().
The framework had an AST validator, so exploitation was not simply a direct call to eval with arbitrary text. Microsoft showed a payload that remained valid under the implemented checks while traversing Python classes to reach an importer and eventually os.system. The result was host-level command execution.
This is a useful example of why a prompt-injection finding and a tool vulnerability must be reconstructed together. The model supplied the data, but the deterministic framework code created the execution sink.
Mechanism and trust boundary
- 01
Inject instructions into agent input
The attacker influences the model's natural-language input.
Boundary: untrusted content / model
- 02
Model fills a tool parameter
The model calls the Search Plugin with an attacker-influenced city value.
Boundary: model output / tool schema
- 03
Framework builds dynamic filter code
The vulnerable filter interpolates the value into a Python lambda expression.
Boundary: tool parameter / code generation
- 04
Validator bypass reaches eval sink
The crafted value survives validation and reaches dynamic execution.
Boundary: validator / Python eval
- 05
Host process executes command
The agent host runs attacker-controlled code.
Boundary: agent framework / operating system
Timeline
- Feb 19, 2026Event type unspecified
GitHub publishes CVE-2026-26030 advisory
The advisory identifies the patched Semantic Kernel Python version.
- May 7, 2026Event type unspecified
Microsoft publishes technical exploit analysis
Microsoft documents the prompt-to-RCE chain and defensive guidance.
Claims & evidence
CLM-RCEMicrosoft reports that CVE-2026-26030 can turn prompt injection into host remote code execution when the agent uses the affected Search Plugin and In-Memory Vector Store filter path.supported
Basis: reported finding
- supportsWhen prompts become shells: RCE vulnerabilities in AI agent frameworksprimary
CVE-2026-26030 section
CLM-BYPASSMicrosoft demonstrated an AST-validation bypass that traversed Python class metadata to load os and execute a shell command.supported
Basis: reported finding
- supportsWhen prompts become shells: RCE vulnerabilities in AI agent frameworksprimary
Exploit and validator analysis
CLM-AFFECTEDThe GitHub advisory lists Semantic Kernel Python versions before 1.39.4 as affected and 1.39.4 as patched.supported
Basis: reported finding
- supportsMicrosoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code executionprimary
Affected versions and patched versions
CLM-EVAL-SINKMicrosoft traces the exploit to model-controlled string interpolation into a Python lambda expression that is executed with eval().supported
Basis: reported finding
- supportsWhen prompts become shells: RCE vulnerabilities in AI agent frameworksprimary
Unsafe string interpolation
Evidence visuals
diagram
Semantic Kernel prompt-to-RCE path
- Injected input
Attacker influences agent input
- Model tool call
Search Plugin receives attacker-influenced city value
- Filter builder
Value interpolated into Python lambda
- AST validator
Crafted expression survives implemented checks
- Python eval
Dynamic expression is executed
- Agent host
Shell command runs on host
- Injected input Model tool call: prompt influence
- Model tool call Filter builder: tool parameter
- Filter builder AST validator: generated code
- AST validator Python eval: bypass
- Python eval Agent host: code execution
Implications
Treat model-controlled tool parameters as attacker-controlled input. Patch the framework, remove unsafe dynamic evaluation paths, and investigate the vulnerable deployment window for host-level indicators rather than assuming a model refusal would have prevented exploitation.
Controls and mitigations
- Upgrade semantic-kernel Python to 1.39.4 or later.
- Treat every model-controlled tool argument as untrusted input.
- Avoid dynamic eval-based filters for attacker-influenced values.
- Hunt the vulnerable deployment window for suspicious child processes, outbound connections and persistence.
- Rotate credentials reachable from any host where exploitation is suspected.
Unknowns and contradictions
- The cited sources do not establish widespread exploitation in the wild.
- Exposure depends on the specific Search Plugin and In-Memory Vector Store configuration.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 1
- Sep 25, 2026 · Published version · material revision · revision 39Public fields changed: assessment_profile
- Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: claims