Prompt Injection Is Now an RCE Primitive
Prompt injection used to be easy to dismiss as a chatbot problem.
The model might reveal instructions, change tone, or produce an embarrassing answer. Important, yes. Remote code execution, no.
Tool-using agents erased that boundary.
Once a model can search, write files, run code, browse the network, query databases, or move artifacts across a sandbox, untrusted language can influence an execution path. The prompt is no longer only content. It can become input to a system primitive.
Microsoft's 2026 research into two Semantic Kernel vulnerabilities made the transition explicit: one path connected model-controlled search input to unsafe dynamic evaluation; another exposed a host-side file-transfer function with a model-controlled destination path. Prompt injection could cross from language into code execution and host file writes.
The defensive question is no longer “Can we detect every malicious instruction?”
It is:
If detection fails, what can the injected instruction actually reach?
Draw the Primitive...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
