Microsoft’s Defender Security Research team published two CVEs against its own Semantic Kernel framework four weeks ago. CVE-2026-26030 sits in the In-Memory Vector Store. CVE-2026-25592 turns the Sessions Python Plugin into an arbitrary file write. The frame the team chose is the part worth sitting with. Not bugs. Architecture. The team’s own words: “developed by design.”

That phrase is the one to mark. When an LLM gets plugins, the model is doing exactly what it was built to do, which is parse natural language into tool calls. If an attacker controls the natural language going in, the attacker controls the tool calls coming out. Prompt injection stops being a content problem at that point. It becomes an execution problem. Microsoft just attached CVE numbers to the obvious.

The Microsoft post then turns to “Defending the agentic edge.” Worth reading. The advice is solid and most of it is about agent-side hardening: permissions, sandboxing, plugin scrutiny, runtime monitoring. What it does not cover is the half before the agent. Before the LLM ever sees the prompt that becomes the shell, the unsafe input has to enter the prompt. That is where heySec is building.

What containment means at the prompt boundary

Containment is the prompt-side answer to the architectural problem Microsoft named. Two specific things at launch, no more:

  1. Containment tags. Every piece of external data going into a prompt is wrapped so the LLM can distinguish “this is your instruction” from “this is hostile content I am asking you to summarise.” That wrapping is enforced at the boundary, not as a stylistic suggestion baked into the system prompt and crossed-fingers.
  2. Threat-level scanning. Every external payload is scored against known prompt-injection patterns and tagged with a risk level the calling application can act on, before it lands inside the agent loop.

That is the claim at T-zero. There is no broad “agentic firewall” coverage in the launch product. There is no runtime tool-call interception. There is no promise that heySec replaces your sandboxing or your permissions model. The thing we ship at launch is the prompt-side defence against the threat Microsoft just published CVEs for.

Why this matters now

Agent framework adoption is outpacing the security posture around it. Semantic Kernel is one of many. If Microsoft’s own security team is publishing CVEs on its own framework, the rest of the field has the same shape, just without the CVE write-up. Teams shipping agents are about to find out which half of the defence stack they own and which half they thought their framework owned. The prompt boundary is in the second category for almost everyone.

Built in the EU

heySec is built in Estonia, hosted in the EU, GDPR-compliant by default. For EU developer teams that read the Microsoft Defender CVEs and started thinking about agent data residency, that lands cleanly. No data export, no cross-border telemetry, no separate DPA conversation to start the conversation.

Invite-only at launch

We are launching invite-only. The reasons are partly capacity and partly correctness. Containment is the kind of thing you want to deploy with the founders watching the first installs, not the kind you bulk-onboard. The invite list is being filled from the developer communities that have been talking about prompt-injection-as-execution-risk publicly for the past year. If your team has been one of them and you would like to test the containment layer against your own agents, the waitlist is at heysec.com.

Microsoft did the field a favour by publishing CVEs that name what was previously a community handwave. Containment at the prompt boundary is one half of the answer. We are shipping that half. The other half is yours.

Reference: When prompts become shells: RCE vulnerabilities in AI agent frameworks, Microsoft Security Blog, 7 May 2026. microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks