Semantic Kernel flaws enable prompt-to-RCE

This is a clean example of the real AI-agent security failure mode: the model is not the boundary, the tools are. Once prompt-driven output can steer evals, file writes, or plugin calls, a chat interface becomes an execution surface.

• –CVE-2026-26030 affects Python Semantic Kernel before 1.39.4 when the In-Memory Vector Store search path is exposed; Microsoft says upgrading removes the risky filter path.
• –CVE-2026-25592 affects .NET Semantic Kernel SDK versions older than 1.71.0 and shows how a sandboxed plugin can still become a write primitive if AI can reach it.
• –The broader lesson is that framework-level convenience abstractions can concentrate risk across every downstream agent built on top of them.
• –Defenders should inventory exposed tools, audit auto-invoked functions, and look for host telemetry like suspicious child processes, outbound connections, and persistence artifacts.
• –This raises the bar for agent framework design: allowlists, strict schema validation, and explicit human approval for sensitive tool calls are not optional extras.