Microsoft disclosed two critical Remote Code Execution vulnerabilities (CVE-2026-25592, CVE-2026-26030) in its Semantic Kernel AI agent framework, affecting organizations that have built AI-powered applications on this platform. An attacker who can inject malicious prompts into an AI agent may be able to execute arbitrary code on the underlying system. Organizations deploying Semantic Kernel in production AI workflows face direct risk of system compromise and potential lateral movement within their environment. Affected versions are not yet confirmed from available data; verify against the Microsoft Security Response Center advisory before scoping your response.