Three independently-disclosed CVE classes in May 2026 (Microsoft Security Response Center's CVE-2026-25592 and CVE-2026-26030 against Semantic Kernel on 7 May 2026; OX Security's MCP STDIO supply-chain advisory traversing every published MCP implementation regardless of language; the Windsurf 1.9544.26 prompt-injection-to-MCP-registration path) share a single structural property: in the default configuration of 2026 agent frameworks, tool-configuration is treated as data the model is allowed to author, which means the deployer's allowlist is enforced against the configured tools rather than against the model's ability to mutate the configuration. The patch surface is therefore the framework default, not the deployer's wrap. The conventional 2024–2025 enterprise treatment of prompt injection — sandbox the agent's reachable surface at deployment time — is necessary but no longer sufficient. The procurement template for an agent vendor must add five framework-layer attestations (tool-configuration as a privileged operation, runtime enumeration of the tool-configuration surface, configuration-mutation telemetry, coordinated-disclosure record on framework-layer issues, MCP protocol-revision commitment) on top of the deployer-control questions that remain in place.

Claim is scoped to enterprises running production agent deployments on the named framework class (Semantic Kernel, MCP clients including Cursor / Windsurf / Claude Code / internal platforms built on the protocol, and the broader class of 2026 frameworks the Microsoft Security Response Center post identifies as sharing the anti-pattern). 60-day review cadence. Trigger conditions for status changes: (1) a published vendor benchmark showing framework-layer tool-configuration enforcement in default builds above 80% of measured surface across Semantic Kernel, MCP clients, and Windsurf (would move toward Partial because the framework defaults have shifted); (2) a second independently-disclosed framework-layer CVE in the same prompt-injection-to-execution class within the review window (would harden the structural argument and keep Holding); (3) a major 2026 production incident with public post-mortem traceable to one of the three named frameworks (would either confirm or refute the operational implication depending on the specific failure path); (4) the emergence of a framework-vendor-issued attestation programme covering tool-configuration as a privileged operation, with a documented enforcement mechanism (would move toward Partial because the procurement pattern has a tooling answer); (5) Anthropic's MCP working group shipping a protocol-level revision that distinguishes user-authored from model-authored configuration as part of the spec rather than as an implementation guideline (would move toward Partial because the protocol-layer fix is the longer path and its completion materially changes the affected surface).