ModelScope: MS-Agent Vulnerability Let Attackers Hijack AI Agent to Gain Full System Control

Critical RCE Vulnerability in MS-Agent AI Framework Exposes Systems to Full Compromise

A severe security flaw (CVE-2026-2256) has been identified in ModelScope’s MS-Agent framework, a lightweight tool enabling AI agents to execute autonomous system commands. The vulnerability, rated 9.8 (CVSS v3.1), allows attackers to perform remote code execution (RCE) by exploiting inadequate input sanitization in the framework’s "Shell tool."

The flaw stems from prompt injection attacks, where malicious commands embedded in seemingly benign input such as documents or code are passed unsanitized to the OS. While MS-Agent employs a basic check_safe() denylist to block dangerous commands, researchers found it can be bypassed through command obfuscation or alternative syntax, rendering the defense ineffective.

Successful exploitation grants attackers arbitrary command execution with the same privileges as the MS-Agent process, enabling:

• Data exfiltration of sensitive files accessible to the AI.
• Modification or deletion of critical system files.
• Persistence mechanisms, including backdoor installation.
• Lateral movement across enterprise networks.

As of the CERT/CC disclosure, the vendor has not released a patch or official response. Organizations using MS-Agent are urged to mitigate risks by sandboxing the agent, enforcing least-privilege access, validating all ingested content, and replacing denylists with strict allowlists to restrict permitted commands. The incident underscores the escalating security risks of AI agents with unchecked OS access.

Source: https://cybersecuritynews.com/ms-agent-vulnerability/

Tongyi Lab cybersecurity rating report: https://www.rankiteo.com/company/alibaba-tongyi-lab

"id": "ALI1772620145",
"linkid": "alibaba-tongyi-lab",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Artificial Intelligence/Technology',
                        'name': 'ModelScope',
                        'type': 'AI Framework Vendor'}],
 'attack_vector': 'Prompt injection attacks via malicious input (documents, '
                  'code)',
 'data_breach': {'data_exfiltration': 'Yes',
                 'type_of_data_compromised': 'Sensitive files accessible to '
                                             'the AI'},
 'description': 'A severe security flaw (CVE-2026-2256) has been identified in '
                'ModelScope’s MS-Agent framework, a lightweight tool enabling '
                'AI agents to execute autonomous system commands. The '
                'vulnerability, rated 9.8 (CVSS v3.1), allows attackers to '
                'perform remote code execution (RCE) by exploiting inadequate '
                "input sanitization in the framework’s 'Shell tool.' The flaw "
                'stems from prompt injection attacks, where malicious commands '
                'embedded in seemingly benign input such as documents or code '
                'are passed unsanitized to the OS. Successful exploitation '
                'grants attackers arbitrary command execution with the same '
                'privileges as the MS-Agent process, enabling data '
                'exfiltration, modification or deletion of critical system '
                'files, persistence mechanisms, and lateral movement across '
                'enterprise networks.',
 'impact': {'data_compromised': 'Sensitive files accessible to the AI',
            'operational_impact': 'Modification or deletion of critical system '
                                  'files, lateral movement across networks',
            'systems_affected': 'Systems running MS-Agent framework'},
 'lessons_learned': 'The incident underscores the escalating security risks of '
                    'AI agents with unchecked OS access.',
 'post_incident_analysis': {'corrective_actions': 'Replace denylists with '
                                                  'strict allowlists, '
                                                  'sandboxing, least-privilege '
                                                  'access, input validation',
                            'root_causes': 'Inadequate input sanitization in '
                                           "MS-Agent's 'Shell tool', "
                                           'bypassable denylist via command '
                                           'obfuscation or alternative syntax'},
 'recommendations': 'Mitigate risks by sandboxing the agent, enforcing '
                    'least-privilege access, validating all ingested content, '
                    'and replacing denylists with strict allowlists to '
                    'restrict permitted commands.',
 'references': [{'source': 'CERT/CC disclosure'}],
 'response': {'containment_measures': 'Sandboxing the agent, enforcing '
                                      'least-privilege access, validating all '
                                      'ingested content, replacing denylists '
                                      'with strict allowlists'},
 'title': 'Critical RCE Vulnerability in MS-Agent AI Framework Exposes Systems '
          'to Full Compromise',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-2256 (Inadequate input sanitization in '
                            "MS-Agent's 'Shell tool')"}