Prompt-to-Shell: Dual RCE Paths in Microsoft…

Use case sources

Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.

Linked library records

Independent products or attack paths are assessed separately. A combined report receives no aggregate score.

Incident overview

Microsoft documented two distinct Semantic Kernel prompt-to-host-RCE paths: a Python Search Plugin filter evaluated with eval(), and a .NET SessionsPythonPlugin file-transfer function exposed to model tool calling that could write a payload into the host Startup folder.

Why this record has no ERS

The combined AIDEFEND item spans independent Python filter eval and .NET session file-write paths. Each has its own bounded workpaper and score; an aggregate ERS would average unlike systems.

Status: Not scorable by design · Classification: Validated Research · source date 2026-06-30 · primary evidence date 2026-05-07

SecureFlow attack flow

This record mirrors an AIDEFEND SecureFlow flow (AIDEFEND curated research flow): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.

Primary research	Microsoft (Microsoft Defender Security Research Team) (2026-05-07)
Primary evidence date	2026-05-07
SecureFlow record updated	2026-06-30
AI layers	Autonomous agents, Tool integrations / MCP
Risk impact	System compromise / RCE, Resource hijacking / cost
Affected components	Microsoft Semantic Kernel agent framework, Semantic Kernel Python In-Memory Vector Store Search Plugin, Default lambda filter evaluated with eval(), Filter blocklist validator, Python class hierarchy / BuiltinImporter / os.system path, Semantic Kernel .NET SessionsPythonPlugin DownloadFileAsync, [KernelFunction] tool exposure boundary, Host file-transfer path validation, Windows Startup folder and agent host process

Attack steps

#	Step	ATLAS tactic / technique
1	Obtain Prompt-Injection Vector into a Semantic Kernel AgentThe attacker supplies a crafted prompt to a Semantic Kernel agent that can invoke framework tools. Microsoft's demonstrations use prompt-controlled input to reach two different vulnerable tool paths; the branches below are separate vulnerabilities, not one chained exploit.	AML.TA0005 AML.T0051.000
2	Inject Python into the Vector-Store eval() FilterIn the Python branch, the default In-Memory Vector Store filter interpolates an AI-controlled Search Plugin argument into a lambda string and evaluates it with eval(). A quote-breaking value turns the intended city comparison into attacker-controlled Python syntax.	AML.TA0005 AML.T0050
3	Bypass the Blocklist via Class-Hierarchy TraversalThe payload remains a syntactically valid lambda while traversing Python's class hierarchy to find BuiltinImporter. It avoids blocked names and restores dangerous capability despite the empty __builtins__ environment.	AML.TA0007 AML.T0107
4	Import os and Run a Shell CommandThe payload loads os and invokes system() with attacker-controlled command text. Microsoft's proof of concept launched calc.exe from the agent process.	AML.TA0005 AML.T0050
5	Invoke [KernelFunction] DownloadFileAsync with an Attacker PathIn the separate .NET branch, SessionsPythonPlugin.DownloadFileAsync was marked [KernelFunction], exposing it to model tool calling. The AI-controlled localFilePath selected an arbitrary host destination for bytes fetched from the sandbox.	AML.TA0005 AML.T0053
6	Write Payload to the Host Startup FolderWithout path validation or a safe-directory restriction, the host-side transfer wrote the sandbox-created script into Windows\Start Menu\Programs\Startup, crossing the isolated dynamic-session boundary.	AML.TA0005 AML.T0053
7	Payload Executes on Next LoginAt the next user sign-in, Windows executes the script from the Startup folder, turning the arbitrary host file write into code execution.	AML.TA0005 AML.T0050
8	Remote Code Execution on the Agent HostEither branch can end in code execution with the privileges and reach of the Semantic Kernel agent host. The two branches converge on the same host-compromise outcome but do not depend on each other.	AML.TA0011 AML.T0112.000

Threat references

AML.T0051.000: LLM Prompt Injection: Direct AML.T0050: Command and Scripting Interpreter AML.T0107: Exploitation for Defense Evasion AML.T0053: AI Agent Tool Invocation AML.T0112.000: Machine Compromise: Local AI Agent

Also modelled as

RCE Vulnerability in Semantic Kernel Search Plugin (same disclosure · MITRE ATLAS case-study conversion)

Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce; AIDEFEND content CC BY 4.0).

AIDEFEND evidence routes

AIDEFEND defences → AITBM sub-metrics

Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.

Technique	Defence	Priority	Evidences
AID-H-025.002	Safe Interpreter EnforcementExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-2, step-3. Presence supplies no score credit.	Candidate evidence route	Cn-3
AID-H-003.010	Deployed AI Software Vulnerability Remediation LifecycleExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-2, step-5. Presence supplies no score credit.	Candidate evidence route	Ro-4 Ro-5 Tr-4
AID-H-025.001	Pre-Execution Static Analysis & Dangerous Construct BlockingExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit.	Candidate evidence route	Cn-3
AID-I-001.002	MicroVM & Low-Level SandboxingExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit.	Candidate evidence route	Pr-2 Cn-7
AID-H-017.002	Least-Privilege Tool ArchitectureExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit.	Candidate evidence route	Cn-5 Cn-7
AID-H-018.002	Policy-Based Access ControlExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit.	Candidate evidence route	Cn-1 Cn-6 Cn-7
AID-I-001.003	Ephemeral Single-Use Sandboxes for ToolsExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit.	Candidate evidence route	Pr-2 Cn-7
AID-E-002	AI Runtime Process, Lease & Pod EvictionExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit.	Candidate evidence route	ACI:containment/behavioral re-attestation ORP:Rf remediation evidence
AID-E-004	Incident Exploit-Path Closure VerificationExact SecureFlow defense-map identifier (flow aidefend-research-sf0004-semantic-kernel-vector-store-eval-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit.	Candidate evidence route	ACI:C_event recovery ACI:containment/behavioral re-attestation

Related AITBM rubrics

Cn-3: Output Filtering Robustness Ro-4: Poisoning Attack Resistance Ro-5: Supply-Chain Artifact Admission Integrity Tr-4: Model Lineage Disclosure Pr-2: Inference Attack Resistance Cn-7: Resource and Execution-Loop Containment Cn-5: Agent Identity Integrity Cn-1: Scope Enforcement Cn-6: Action Reversibility Classification Rate

Prompt-to-Shell: Dual RCE Paths in Microsoft Semantic Kernel