Vulnerability in MS-Agent AI Framework Can Allow Full System Compromise

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Command Injection Vulnerability in MS-Agent Framework Discovered A command injection vulnerability was identified in the MS-Agent framework, allowing attackers to exploit improper input sanitization through its shell tool. This flaw can lead to arbitrary command execution on systems where the framework is deployed. As of March 2, 2026, no patch or vendor statement has been issued. 7 sources 32