Critical RCE Vulnerability in MS-Agent AI Framework Exposes Systems to Full Compromise A severe security flaw (CVE-2026-2256) has been identified in ModelScope’s MS-Agent framework, a lightweight tool enabling AI agents to execute autonomous system commands. The vulnerability, rated 9.8 (CVSS v3.1), allows attackers to perform remote code execution (RCE) by exploiting inadequate input sanitization in the framework’s "Shell tool." The flaw stems from prompt injection attacks, where malicious commands embedded in seemingly benign input such as documents or code are passed unsanitized to the OS. While MS-Agent employs a basic `check_safe()` denylist to block dangerous commands, researchers found it can be bypassed through command obfuscation or alternative syntax, rendering the defense ineffective. Successful exploitation grants attackers arbitrary command execution with the same privileges as the MS-Agent process, enabling: - Data exfiltration of sensitive files accessible to the AI. - Modification or deletion of critical system files. - Persistence mechanisms, including backdoor installation. - Lateral movement across enterprise networks. As of the CERT/CC disclosure, the vendor has not released a patch or official response. Organizations using MS-Agent are urged to mitigate risks by sandboxing the agent, enforcing least-privilege access, validating all ingested content, and replacing denylists with strict allowlists to restrict permitted commands. The incident underscores the escalating security risks of AI agents with unchecked OS access.