Prompt injection just crossed the RCE threshold: what the May 2026 Semantic Kernel and MCP CVEs mean for enterprise AI agent frameworks

Microsoft Security Response Center published two advisories against Semantic Kernel on 7 May 2026: CVE-2026-25592 and CVE-2026-26030 (Microsoft Security Blog, When prompts become shells: RCE vulnerabilities in AI agent frameworks, 7 May 2026). Both demonstrate the same shape: a single attacker-controlled prompt, delivered through any input channel the agent reads from, resolves to host-level code execution on the device running the agent. The proof-of-concept in the public write-up is the canonical case: a prompt that launches calc.exe on the host. The implication for enterprise architecture is not the demonstration; it is what the demonstration proves about the framework’s default trust boundary.

The same fortnight, OX Security published a supply-chain advisory covering Anthropic’s Model Context Protocol STDIO interface (OX Security, MCP Supply-Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem, 2026). The advisory documents that the STDIO command-injection path is present in every published MCP implementation regardless of language, with the command line itself acting as the payload. A separate disclosure against Windsurf 1.9544.26 (Practical DevSecOps, MCP Security Vulnerabilities 2026) showed a prompt-injection path that writes to the local MCP configuration file and registers a malicious server entry that the IDE loads on its next session, with no user interaction required.

Three CVE classes, three frameworks, one fortnight. The natural enterprise reading is that May 2026 had a coincidence of disclosures. The structural reading is different.

What the three CVEs share

The conventional treatment of prompt injection through summer 2025 placed the threat boundary between the model’s output and the tools the deployer had explicitly registered. The deployer would restrict the agent’s toolset, run the agent under a low-privilege account, block egress to sensitive systems, and trust the framework to keep the model’s authored content separated from the configuration the framework executed against. That model is what Microsoft’s own threat-modelling guidance documented through 2024 and 2025, what Anthropic’s MCP specification assumed in the original protocol design, and what every major agent vendor’s threat-modelling documentation reflects today.

The May 2026 CVE class breaks this assumption at the framework layer. In the Semantic Kernel demonstration, the prompt injection authors a new tool configuration that the framework executes inside the agent process. In the MCP STDIO class, the prompt injection alters the configuration the agent uses to launch a server, where the command line itself is the payload. In the Windsurf class, the prompt injection writes to the local MCP configuration file and installs a new server entry that the IDE loads on its next session.

The three demonstrations share a single property: the framework, by default, treats tool-configuration as data the model is allowed to author. The deployer’s allowlist is enforced against the configured tools, not against the model’s ability to mutate the configuration. The patch surface is therefore the framework default, not the deployer’s wrap.

The Microsoft Security Response Center post is explicit about the structural read. The CVE class is described as a representative instance of an anti-pattern observable across multiple frameworks the team examined privately, and the recommended mitigation is at the framework default, not the deployer’s configuration (Microsoft Security Blog, 7 May 2026).

The MCP STDIO path is a protocol-level disclosure

The OX Security advisory is the broader of the three, because it traverses the protocol itself rather than a specific framework’s implementation of it. The MCP STDIO interface specifies that an MCP server is launched as a subprocess, with the server’s command line and arguments declared in the client’s configuration. The advisory documents that the command line is constructed from configuration values without sufficient escaping in every implementation that OX Security reviewed, regardless of language.

The Anthropic disclosure was characterised in the coordinated release as a design-level issue rather than an implementation defect (The Hacker News, Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain, April 2026). Anthropic acknowledged the disclosure and indicated that a protocol-level revision is under discussion in the MCP working group. The implementation-level fixes shipping across MCP clients in late April and early May are the near-term mitigation; the protocol-level revision is the longer path because every published MCP implementation has to update once the protocol changes.

For enterprise CIOs, the load-bearing fact is that the MCP STDIO surface is not a Microsoft surface, an Anthropic surface, or a Cursor surface. It is a protocol surface. The enterprise stack that includes any MCP client (Cursor, Windsurf, Claude Code, internal agent platforms built on the protocol) inherits the protocol-level disclosure. The patch coverage required is not single-vendor.

The Windsurf path is a user-experience problem masquerading as a security problem

The Windsurf 1.9544.26 disclosure is narrower in technical scope but worth treating separately because it illustrates a class of failure that procurement reviews do not currently catch. The advisory documents that when Windsurf processes attacker-controlled HTML content (the most common path is a webpage rendered in the editor’s preview window, but any HTML-handling path is in scope), embedded malicious instructions can cause the editor to write a new entry into the user’s MCP configuration file. The next time Windsurf starts an MCP session, the malicious server is launched as a subprocess, and arbitrary commands run with the user’s privileges.

The disclosure path requires no user interaction beyond rendering attacker-controlled HTML. That is the property that matters. The MCP configuration file is not protected by the editor’s permission model in the way that the local filesystem is, because the configuration file is treated as part of the editor’s settings surface, which is editor-writable by design. The vulnerability is a category error in the trust model: the editor’s settings file is treated as user-authored, but the prompt-injection path makes it model-authored, and the framework does not distinguish between the two.

This is the most operationally relevant of the three for a CIO whose engineering organisation uses AI-augmented IDEs. The threat path does not require a malicious dependency, a poisoned model, or a compromised credential. It requires that the engineer rendered an attacker-controlled webpage in the editor, which is a routine action, because most engineers preview release notes, design documents, internal documentation, and Slack messages inside their IDE every day.

What the framework-layer property means for procurement

The procurement implication is the largest single shift in agent-security guidance since the 2024 enterprise wave of generative AI restrictions. Through 2024 and 2025, the procurement template for an agent vendor asked about the deployer’s controls: what tools were available to the agent, what credentials the agent ran under, what egress was permitted, what was logged. Those questions remain necessary and are not displaced by the May 2026 disclosures. They are no longer sufficient.

The framework-layer property requires a second class of question: how the framework treats tool-configuration as a trust boundary. A framework that treats tool-configuration as model-authored input cannot be made safe by the deployer’s wrap, because the wrap operates on the configuration the framework actually executes against, and the model can rewrite that configuration through the prompt-injection path.

The procurement-template extension is concrete. The agent-vendor questionnaire should ask: (1) does the framework treat tool-configuration as a privileged operation requiring out-of-band authorisation, separate from the model’s text-output channel; (2) is the framework’s tool-configuration surface enumerable at runtime, so a deployer can audit it; (3) is the framework’s tool-configuration mutation event logged with sufficient detail to detect anomalous mutations by the agent process itself; (4) what is the vendor’s coordinated-disclosure record on framework-layer issues in the prior twelve months; (5) what is the vendor’s commitment to the protocol-level revision of MCP if the deployer’s stack includes MCP clients. Vendors that cannot answer (1) and (3) are signalling that the framework-layer fix has not shipped, and the deployer’s risk is the residual.

The five controls that follow from this (version freeze, centrally-managed MCP allowlist with binary verification, agent-process isolation, configuration-mutation telemetry, vendor framework-attestation requirement) are listed in the FAQ above the article body. They are not the operational depth of the patch; they are the architectural shape the patch implies.

How AM-155 and AM-156 connect to the framework layer

The three Risk-arc pieces published in May 2026 are independently citable but they map a single failure surface together.

AM-155 (Storm-0558 and the structural risk in AI agent credentials) examined the credential layer: the conditions that allowed Storm-0558 (a seven-year-old signing key, environment-separation enforced procedurally, crash-dump telemetry leaking plaintext, no issuance-and-use baseline) are the conditions that hold for most enterprise AI agent credentials in 2026. The CSRB report was read as forward-readable: a structural map of where the agent-identity programme fails, not a Microsoft post-mortem.

AM-156 (The Samsung lesson for shadow AI) examined the capability-surface layer: the detection lag observed in Samsung’s 2023 ChatGPT incidents was the structural output of running DLP designed against email/file/removable-media against a new egress class (paste-into-chat-interface). The 2026 inversion of the pattern (agentic capability silently activating inside approved tools) makes the lag worse.

AM-157 examines the execution-authority layer. Once the credential has been used and the capability surface has been reached, what authority does the agent execute under? The framework-layer CVEs are the answer: in the default configuration of 2026 agent frameworks, the answer is “more than the deployer thought”, because the model can mutate the configuration the framework executes against.

The three layers compose. A 2026 enterprise that has hardened the credential layer (AM-155) and inventoried the capability surface (AM-156) is still exposed at the execution layer if the framework default is unchanged. Conversely, framework-attestation alone does not close the credential layer or the capability layer. The procurement-template extension above is one of three; the trilogy maps the full set.

The base-rate context that procurement should hold open

The OWASP 2026 survey figures introduced in AM-155 are the population estimate for this piece as well: 73% of live AI rollouts have flaws open to prompt injection, and only 34.7% of firms have set up specific defences. The May 2026 framework-layer CVE class is layered on top of that base rate. The implication is that the 34.7% who have defences may still be exposed at the framework layer, because the defences were authored against the pre-May 2026 threat model.

The cohort that ran the pre-May 2026 prompt-injection threat model and judged the residual risk acceptable should re-run the calculation. The cohort that did not have defences should treat the May 2026 disclosures as a forcing function for the procurement-template extension. Both cohorts converge on the same operational change.

What to read next

For the credential-layer treatment, see AM-155: Storm-0558 and the structural risk in AI agent credentials. For the capability-surface treatment, see AM-156: The Samsung lesson for shadow AI and the operational sequel AM-036: shadow-AI discovery playbook. For the procurement-template baseline that this piece extends, see AM-145: AI vendor exit clauses and AM-143: AI Bill of Materials.

The operators-section sibling, oriented to small agencies running Cursor or Windsurf for paid client work without an IT team, is at OPS-067.