Prompt Injection Is Now an RCE Primitive

Prompt injection used to be easy to dismiss as a chatbot problem. The model might reveal instructions, change tone, or produce an embarrassing answer. Important, yes. Remote code execution, no. Tool-using agents erased that boundary. Once a model can search, write files, run code, browse the network, query databases, or move artifacts across a sandbox, untrusted language can influence an execution path. The prompt is no longer only content. It can become input to a system primitive. Microsoft's 2026 research into two Semantic Kernel vulnerabilities made the transition explicit: one path connected model-controlled search input to unsafe dynamic evaluation; another exposed a host-side file-transfer function with a model-controlled destination path. Prompt injection could cross from language into code execution and host file writes. The defensive question is no longer “Can we detect every malicious instruction?” It is: If detection fails, what can the injected instruction actually reach? Draw the Primitive Reachability Graph Threat-model the agent as a graph: untrusted content → model context → tool proposal → argument transformation → execution primitive → identity, filesystem, network, and secrets Untrusted content includes more than the user message: retrieved documents; web pages; emails and attachments; issue comments; tool outputs; long-term memory; images processed by OCR; generated artifacts from another agent. For each source, list the reachable tools. For each tool, list the primitive: search filter → dynamic expression evaluator download file → host filesystem write browser → authenticated session and network shell → process execution database query → data read/write MCP tool → remote server capability Then attach credentials, egress, writable paths, and approval requirements. This graph reveals the blast radius before anyone argues about prompt wording. Remove the Edge Before Filtering the Text The most reliable control is absence. If the model does not need a host file-download helper, do not expose it as a tool. Microsoft's remediation for the file-transfer vulnerability removed AI access to the dangerous function, breaking the attack chain at the capability edge. Use per-task tool allowlists. A support summarizer should not discover shell, browser, payment, or file-write tools. A research agent may browse but should not inherit the user's authenticated admin session. A code agent may write only inside a task workspace, not arbitrary host paths. Tool discovery is authority discovery. Minimize it dynamically. A schema that says city: string does not make the string safe for evaluation. A schema that says path: string does not make it safe for the filesystem. Validate at the primitive boundary: parse structured values rather than interpolating code; use AST or operation allowlists instead of fragile blocklists where expressions are unavoidable; canonicalize paths and verify containment after resolution; parse URLs and enforce scheme, destination, IP range, redirects, and DNS behavior; parameterize database queries; bound sizes, recursion, and decompression; reject unknown fields; validate post-conditions. The model should not build shell commands, SQL, code expressions, or raw file destinations when a narrow typed operation can express the task. Replace: execute(command: string) with: resize_image(input_artifact_id, width, height) Capability design is security design. Isolate the Runtime as if Injection Will Succeed Prompt filters, classifiers, and model instructions can reduce risk. None should be the final boundary. A tool runner needs: separate non-human identity; short-lived credentials; read-only or task-scoped mounts; a disposable workspace; CPU, memory, process, and time limits; default-deny network egress; explicit destination allowlists; no host socket or cloud metadata access; secret injection only for the exact operation; teardown and artifact scanning. Containerization helps only when the host-side bridge is also constrained. The Microsoft file-transfer case is instructive: sandboxed code could become dangerous because a helper operating outside the sandbox moved a file to a model-controlled host path. Audit every bridge that crosses isolation: upload, download, browser session import, clipboard, artifact export, and callback. The model proposes: {"tool": "download_report", "arguments": {"artifact_id": "a_...", "target": "reports"}} The gateway: authenticates actor and agent; resolves artifact ownership; maps logical target to an allowlisted directory; canonicalizes the final path; checks policy and risk; applies a stable idempotency identity; executes inside the restricted runner; scans and records the result. The model never receives arbitrary host-path authority. High-risk actions need human approval bound to the exact canonical request. Approval cannot be “the agent may write a file.” It is “this actor approves exporting this artifact to this destination before this expiry.” Control Egress and the Response Path An injected agent does not need local code execution to cause damage. It may exfiltrate data through an HTTP request, DNS, webhook, image URL, or tool argument. Default-deny egress is the baseline for sandboxes and high-risk tools. Allow destinations by task, resolve addresses safely, constrain redirects, and proxy traffic through a gateway that logs destination, method, size, and policy decision. Filter tool results before returning them to the model. A compromised tool server can send new instructions, huge payloads, secrets, or malicious markup. Tool output is untrusted input in the next loop. The trust boundary is bidirectional. Make Credentials Smaller Than the Agent Avoid one powerful service account for every tool. Use: audience-bound tokens; per-tool scopes; tenant and resource restrictions; short expiry; just-in-time issuance; no refresh token inside the model context; immediate revocation path; separate read and write identities. The agent should not see raw credentials. The gateway injects them after policy allows a call. If the runner is compromised, the available token should be unable to administer the whole environment. Detect at the Model and Host Layers Detection should correlate: Agent layer unusual tool choice; argument anomaly; policy denial; repeated attempts after denial; prompt-injection classifier signal; new external destination; tool sequence outside baseline. Host layer child processes from the agent runtime; unexpected shell or scripting engine; writes to startup, configuration, credential, or executable paths; outbound connections outside policy; persistence behavior; secret access; privilege escalation. Microsoft's guidance emphasizes both layers. If an agent framework vulnerability produced host execution before patching, incident responders need the vulnerable deployment window, endpoint telemetry, network evidence, reachable credentials, and affected resources. Prompt logs alone are not an incident record. Patch, Then Investigate the Window Upgrading closes a known vulnerable path. It does not prove the path was never used. For a disclosed agent vulnerability: inventory affected framework versions and configurations; define first deployment and patch times; identify tools and identities reachable during that window; search agent, endpoint, file, and network telemetry; quarantine suspicious hosts and runs; rotate accessible credentials; review persistence and downstream changes; preserve receipts and evidence. Treat successful RCE as host compromise, not as a bad chat response. Red-Team the Reachability Graph Test every untrusted source against every reachable primitive: direct and indirect prompt injection; malicious retrieved documents; poisoned memory; tool-output injection; path traversal; SSRF and redirect chains; code/template/SQL interpolation; oversized and recursive artifacts; multi-agent delegation that expands tools; approval reuse; cancellation followed by late execution. The success criterion is not “the model refused.” It is “the prohibited primitive did not execute, and the attempt was observable.” OWASP's agentic-security guidance provides a useful taxonomy across excessive agency, tool misuse, identity and privilege, memory, supply chain, and related risks. Map those categories to your concrete graph. Design for the Failed Filter Prompt injection is hard because useful agents must process untrusted language. The model cannot perfectly distinguish data from instructions in every representation. That does not make defense hopeless. It changes the objective. Break the chain at multiple edges: reduce exposed tools; narrow each primitive; validate canonical inputs; enforce policy outside the model; isolate execution; restrict credentials and egress; require scoped approval; monitor host behavior; preserve receipts for response. The prompt filter can fail. The classifier can miss. The model can comply with the attacker. The architecture should still keep a string from becoming a shell.