When prompts become shells: the tool registry is the attack surface

On May 7, 2026, Microsoft published " When Prompts Become Shells: RCE vulnerabilities in AI agent frameworks " — a retrospective on two Critical (9.9) CVEs in Semantic Kernel that landed in February and were patched within days. The CVEs are bad. The framing is worse — and worth reading carefully. The two CVEs CVE-2026-26030 — eval() on attacker-controlled filter strings InMemoryVectorStore accepts user-supplied filter expressions and evaluates them. Filter strings are interpolated into a Python