Prompt Injection Is Now an RCE Primitive for AI Agents

Tool-using AI agents have turned prompt injection from a chatbot annoyance into a genuine remote-code-execution risk. Once a model can search, write files, run code, or reach the network, untrusted text stops being mere content and becomes input to a system primitive. Two Microsoft-disclosed Semantic Kernel vulnerabilities made this explicit: model-controlled search input reaching unsafe dynamic evaluation, and a model-controlled destination path reaching a host-side file-transfer function.

The key defensive shift is moving from 'can we catch every malicious instruction' to 'what can an injected instruction actually reach if detection fails.' That requires mapping a reachability graph from untrusted sources through model context, tool proposals, and argument transformation down to execution primitives, credentials, and network egress.

Recommended controls include removing unnecessary tools rather than filtering around them, treating every tool argument as attacker-controlled and validating at the primitive boundary, isolating the runtime as though injection will succeed, scoping credentials smaller than the agent itself, and correlating detection signals at both the agent and host layers. For already-patched vulnerabilities, upgrading alone isn't enough — teams need to investigate the vulnerable deployment window for reachable tools, identities, and evidence of compromise.