Your LLM Is Not a Security Boundary: Auditing Agent Tools for eval() and Path Sinks

In May 2026, Microsoft's security team published two remote-code-execution issues in its own agent...