Posts

A Prompt Injection Turned Into a Shell: Inside Semantic Kernel's Two RCE CVEs

Image
Two ordinary agent-framework conveniences, a filterable vector search and a file-download tool, turned into remote code execution once an LLM's output was trusted a little too much. Here's what happened in Microsoft Semantic Kernel, and what to check in your own agent code today. Prompt injection usually gets discussed as an output-quality problem: the model says something it shouldn't, or does something a user didn't ask for. CVE-2026-26030 and CVE-2026-25592, two vulnerabilities Microsoft disclosed in its Semantic Kernel framework, are a sharper reminder of what it can become: full remote code execution, demonstrated in Microsoft's own writeup by launching calc.exe on the machine running the agent. Semantic Kernel is Microsoft's open-source framework for building agents and wiring LLMs into tool-calling applications, widely used both inside Microsoft's own ecosystem and in third-party projects. Both vulnerabilities follow the same underlying pattern in ...

Your Agent's Real Bottleneck Isn't the Prompt. It's the Context.

Image
Ask most teams how they manage what their coding agent sees over a long session, and the honest answer is: they do not, really. Context accumulates — tool outputs, file contents, prior turns — until the window fills or the agent starts making mistakes it would not have made ten turns earlier. That degradation has a name now, context rot, and it is the actual bottleneck on long-horizon agent tasks, not prompt wording. The framework Current research and production practice converge on four strategies for managing an agent's context deliberately instead of letting it accumulate by default: Write: persist information outside the active context window instead of keeping it all in-line. The common pattern is a scratchpad the agent writes progress notes to, so it can recover task state without re-reading everything that led up to it. Select: pull in only what is relevant to the current step, using retrieval and relevance scoring instead of dumping an entire file or history into conte...

AWS Just Told Nvidia It Has a Backup Plan. Its Name Is Qualcomm.

Image
A $60 billion, decade-long deal for custom inference silicon doesn't retire Trainium or a single Nvidia GPU. It's AWS buying itself a fourth chip supplier — and that's the more interesting story. On September 8, Qualcomm and Amazon announced a multi-generation partnership to develop custom AI chips and high-speed optical interconnects for AWS data centers, in a deal reported to be worth up to $60 billion over ten years. As part of the arrangement, Qualcomm is issuing Amazon warrants to acquire up to $4 billion of Qualcomm stock — tying the chipmaker's equity upside directly to the success of the partnership. What's actually in the deal The collaboration centers on two things: custom silicon purpose-built for AI inference workloads, and 1.6 Tbps optical connectivity to link those chips at data-center scale. That inference-specific focus matters — this isn't a bid to displace Nvidia GPUs for model training, where Nvidia's software ecosystem (CUDA, and the s...

DeepSeek's New Model Isn't Interesting Because of Benchmarks. It's the Pricing.

Image
Another open-weight model beating a frontier benchmark isn't news anymore. A pricing structure that makes long-context work ten times cheaper at certain hours might actually change how you architect a product. What DeepSeek shipped DeepSeek released V4.1 Flash on September 10, 2026, according to the company's own API changelog and coverage from VentureBeat, Dataconomy, and DataCamp. It's a mixture-of-experts model with a reported 552-billion-parameter backbone, native vision support, and a 1-million-token context window, released under an MIT license with weights available on Hugging Face for commercial use. On published benchmarks, DeepSeek reports 90.6 on Terminal-Bench 2.1 (up from 82.7 on the prior V4 Flash release) and 74.2% on DeepSWE v1.1 (up from 54.4%), alongside a 3,471 Codeforces rating and 90.9 on GPQA Diamond. VentureBeat's coverage frames these as "eclipsing" GPT-5.6 Sol and Claude Opus 5 on select metrics, though it's worth being precise:...

An Attacker's Multi-Agent Framework Stole Thousands of Credentials in Under Six Hours

Image
A financially motivated attacker ran reconnaissance, exploitation, and cleanup with almost no human in the loop — using the same design patterns you'd use to build a helpful agent. That symmetry is the actual story. What Google's threat researchers found Google's Threat Intelligence Group (GTIG) published its Q3 2026 AI Threat Tracker documenting a mass credential-harvesting campaign carried out largely by a multi-agent framework rather than a human operator. According to GTIG's report and coverage from The Hacker News, SiliconANGLE, and Help Net Security, a suspected financially motivated actor gained access to an organization's cloud infrastructure, then deployed an autonomous multi-agent system from inside that environment — which let requests originate from legitimate-looking IP addresses rather than obviously malicious infrastructure. The attacker reportedly built the framework using an AI coding chatbot, a set of instructions, and preconfigured Markdown fil...

GitHub's New Copilot Mode Picks a Different Model for Every Step of Your Task

GitHub's Project HydraFusion doesn't pick one model for your coding task — it builds a small execution plan per task and routes across models mid-task. It's a formalization of patterns a lot of teams already hand-roll in production agents, which makes it a useful reference architecture even if you never turn it on. What it actually is On September 4–5, 2026, GitHub shipped Project HydraFusion as a research preview inside Copilot CLI, accessible via an /experimental flag to users on any Copilot plan ( GitHub Blog ). Rather than statically routing a task to one chosen model, HydraFusion builds a runtime execution plan per task and selects from one of three patterns ( MarkTechPost ): Single — one selected model solves the task directly, no orchestration overhead. The default for tasks the router judges simple. Cascade — a cheaper, faster model drafts a solution first; a quality gate evaluates the draft and either accepts it or escalates the task to a stronger (more exp...