Assume the model gets tricked. Contain what happens next.
An agent reads attacker-controlled data — a web page, a file, another tool's output — and treats it as instructions. No model release patches that away. What you can decide is what the tricked agent is holding when it happens, and what it is allowed to reach.
Three shipped products. Same mechanism, three payoffs.
None of these needed a model jailbreak. Each one needed the agent to be holding something, or able to reach something, that it did not need.
GitHub Copilot Codespaces
Prompt injection in a repo made Copilot read GITHUB_TOKEN from its own environment and emit it through the model output. The token was in env vars because that is where Codespaces puts it.
EchoLeak — Microsoft 365 Copilot
A single crafted email caused Copilot to read across OneDrive, SharePoint, and Teams during routine summarisation and exfiltrate the contents. Zero clicks. Broad filesystem reach made cross-source exfil possible.
AI IDEs, schema-validator leak
Agents wrote JSON files referencing attacker-hosted schema URLs. The editor's schema validator fetched the URL — leaking the file's contents in the request. The agent never explicitly sent the data; the validator did.
This is not a tail risk.
The attack surface is new, widely deployed, and being probed faster than it is being hardened.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.