Anthropic disclosed that a Chinese state-sponsored group it tracks as GTG-1002 manipulated Claude Code into attempting infiltration against roughly 30 organizations, with the AI reportedly carrying out most of the tactical work and minimal human involvement. The humans set direction and made decisions at key points. The model handled the volume of tactical steps that would normally occupy an operator for days. Original reporting for this article comes from CSO Online.
Months earlier, researchers at Aim Security disclosed EchoLeak, a zero-click prompt injection flaw in Microsoft 365 Copilot carrying a CVSS score of 9.3. A single crafted email, ingested during routine summarization, triggered data exfiltration from OneDrive, SharePoint and Teams with no user interaction at all. Nobody clicked a link. Nobody opened an attachment. The agent read content it was designed to read, and that was enough.
These two disclosures belong in the same conversation because they describe opposite ends of the same shift. In one, the AI assistant is the intrusion tool. In the other, the AI assistant is the way in. If you have rolled out Copilot to your staff or a coding assistant to your developers, you now hold both of those exposures inside your own tenant.
OWASP's LLM Top 10 now ranks prompt injection as the number one threat facing these systems.
The practical difference for your incident response is tempo. A phishing email can sit unread in an inbox for a day before anyone clicks it. An agent with live credentials and registered tools acts on poisoned input the moment it processes that input, and it can chain tool calls across connected systems while your team is still reading the first alert.
Obsidian Security's analysis of the Salesloft-Drift OAuth compromise showed a single connected app cascading into hundreds of downstream SaaS environments. Agents hold those same tokens and call those same APIs on your behalf.
How the GTG-1002 Operation Used Agentic AI in the Attack Chain
The part of the GTG-1002 chain that changes defensive math is where the malicious input lives. There is no dropper, no attachment to detonate and no link to sandbox. The instruction arrives as content the agent was built to read, and the agent supplies the execution.
That reframes every stage of the kill chain. The operator does not need to authenticate to your systems, because the agent already has. Credentials, API keys and OAuth tokens sit with the agent identity, so reconnaissance, enumeration and data access all occur inside a session that carries legitimate entitlements and generates logs that look like normal automation.
The observable tradecraft shows up as three patterns rather than as malware artifacts:
- Tool-call volume from a single agent identity that is statistically abnormal, which is what tactical work at machine tempo looks like in telemetry.
- Activity outside the agent's declared task scope, such as an email-summarization agent querying a file share.
- Outputs that reference instructions no human operator issued, which is often the first evidence that the agent's reasoning was redirected by retrieved content.
For a defender, that means the intrusion signal is behavioral. Signature-based tooling has nothing to match on, because the injected instruction is plain text inside a document, a tool response or a memory store the agent trusts.
Persistence is the stage most teams underestimate. An agent working through a task will create infrastructure to keep working: a scheduled task, a mailbox forwarding rule, a fresh API key. Those artifacts outlive the session that created them, and they are indistinguishable from routine automation unless someone reconciles them against a change record. Autonomous agents are frequently better at persistence than the engineers who deployed them.
The lateral movement problem is a token problem. Obsidian Security's analysis of the Salesloft-Drift OAuth compromise traced how one compromised connected app cascaded into hundreds of downstream SaaS environments, and that cascade happened without an agent in the loop. Put an agent in the middle, holding those tokens and chaining tool calls across systems, and the same structural weakness expands: one poisoned ingestion path reaches every service the agent is entitled to touch.
Indirect prompt injection also rarely produces a single victim. If a poisoned document sits in a shared repository, every session that retrieved it is a candidate compromise, which turns scoping into a search across sessions and agents built on the same base configuration or tool integration. A vulnerable pattern replicates across an agent fleet quietly, because each copy behaves normally until it ingests the trigger.
Two operational consequences follow. The first is tempo: the tactical volume that would occupy a human operator across days compresses into the window in which your on-call engineer is still acknowledging the page. The second is skill floor. When the model performs the tactical steps and the human sets direction, the operator needs judgment about targets and objectives more than hands-on-keyboard capability with each tool in the chain.
The forensic evidence also splits into two categories worth separating early. If the agent's reasoning output shows it identified the instruction as suspicious and acted anyway, the failure sits in the guardrail. If it never flagged the instruction at all, the failure sits in detection. Those point at different root causes and different owners inside your organization.
EchoLeak and the Zero-Click Exposure in Microsoft 365 Copilot
The defining property of an EchoLeak-class attack is that the victim never takes an action. No click, no download, no credential entry. The exploit completes during a routine assistant task that the user asked for, or that the assistant performs on a schedule.
The mechanism sits in retrieval-augmented generation, the process by which an assistant pulls documents, emails and chat history into its context window so it can answer questions about your own data. Retrieval is indiscriminate by design. When an assistant fetches the ten most relevant items to summarize an inbox, it does not distinguish between a message from your CFO and a message from an unknown external sender, because both are just text entering the same prompt.
Prompt injection abuses that indifference. An attacker embeds instructions inside content that looks ordinary to a human reader, often hidden in white text, HTML comments, image alt attributes or the tail of a long document that nobody scrolls to. The model reads the whole thing and has no reliable way to separate data it was asked to process from instructions it was asked to follow.
OWASP's LLM Top 10 ranks this class as the number one threat facing these systems, and the reason is structural rather than implementation-specific. There is no input validation routine that fixes it, because the malicious input is well-formed natural language.
The concept worth internalizing is LLM scope violation: untrusted external content steering an agent that holds privileged access to internal data. The agent is the confused deputy. It has a legitimate token, legitimate entitlements and a legitimate reason to read the attacker's message. When it acts on the injected instruction, every downstream request carries the user's authority.
The attacker never authenticates to the tenant. The assistant does it for them, using access it was granted on purpose.
Exfiltration in this pattern rides on whatever the assistant is allowed to render or fetch. Markdown image references and hyperlinks are the common carriers: the model composes a reference to an attacker-controlled URL and appends the retrieved data as a query parameter, and the rendering client performs the outbound request automatically when it displays the response. That maps cleanly to Exfiltration Over Web Service (T1567), with the twist that the request originates from a trusted first-party client rather than from malware on an endpoint.
For your security operations, that means the telemetry looks wrong in a specific way. There is no anomalous process, no new binary, no unusual logon. There is a normal user, in a normal session, and a data access pattern that the assistant is fully permitted to perform. Traditional data loss prevention keyed to email attachments and file downloads does not see it, because the data leaves as characters in a URL.
Copilot is delivered as a cloud service, so remediation for the disclosed flaw happened on Microsoft's side without any build for administrators to deploy. That is worth understanding, because it also means tenants had limited visibility into whether they were affected before the fix landed.
The pattern generalizes. Any assistant that combines retrieval over internal content, privileged access and the ability to emit rendered output carries the same exposure, including internal knowledge-base bots, CRM copilots and ticketing assistants built on your own stack.
Business Consequences of AI Assistants With Broad Data Access
An AI assistant runs with the permissions of the person who invoked it. That single design decision converts years of accumulated SharePoint and Teams over-permissioning into a live exfiltration path, because the assistant can retrieve anything the requesting account is technically allowed to open, including material that account was never meant to browse.
Most organisations have this problem already and cannot see it. Open-to-all-employees sites, inherited folder permissions from a departed team, a Teams channel that was never archived after a project closed. A human employee would have to go looking. Your assistant retrieves it automatically as part of answering an ordinary question.
The content that sits in those forgotten locations is usually the content you would least like summarised into an attacker-controlled channel:
- Legal files covering active litigation, settlement positions and privileged counsel advice
- HR records including disciplinary cases, compensation bands and medical accommodation notes
- M&A working documents, valuation models and diligence checklists that carry market-sensitive information
- Board minutes and internal audit findings that describe your own control weaknesses
Privilege is fragile once material leaves your control, and a leaked settlement range changes what the other side will accept. Deal material carries its own exposure, since premature disclosure of a transaction can affect pricing and, for listed entities, trigger disclosure obligations you did not plan for.
Regulatory treatment is where this becomes uncomfortable. Under GDPR, a transfer of personal data outside your control is a personal data breach whether a person or a model performed it, and the reporting clock does not pause while you work out which one it was. You will be asked which data subjects were affected, and answering that requires knowing exactly which documents the assistant retrieved into its context before the anomalous output. Sector rules add layers on top for financial services, health and legal practices, where the supervisor cares about client confidentiality independently of data protection law.
Then there is the demonstrability problem. Regulators generally expect you to show that a human authorised the processing or that the automated processing was governed. When an assistant moves regulated data on its own initiative, following instructions embedded in a document, you have no approval record to point to and no individual who made the decision.
Your investigation costs rise for a related reason. The logs show a legitimate service account or a licensed user identity performing authorised API calls at an authorised time. There is no failed authentication, no unusual source address, no malware sample to hand to a forensics firm. Establishing what happened means reconstructing retrieval history and tool calls, which most organisations retain for shorter periods than they retain endpoint telemetry, if they retain them at all.
Insurers and clients will ask you a question you may struggle to answer: can you prove which records were accessed? Where you cannot narrow the set, the practical outcome is over-notification. You tell more customers than were actually affected, because that is the only defensible position, and you absorb the commercial consequences of that wider notice.
The economics on the attacker side matter for mid-sized firms in particular. When a model performs the bulk of reconnaissance and enumeration, the operator cost per target falls sharply. Campaign capability that previously justified attention only against large or strategically significant organisations becomes affordable to point at a two-hundred-person professional services firm, a regional manufacturer or a specialist supplier inside someone else's chain. If you assumed you were below the threshold of state-linked interest, that assumption was priced on human operator time.
Controls to Apply to Copilot, Claude Code and Other AI Agents
Start with a permissions audit of SharePoint, OneDrive and Teams before you expand any assistant rollout further. Inventory open-to-all-employees sites, inherited folder rights and orphaned channels, and remediate them as a prerequisite for onboarding new users, because the assistant inherits whatever the invoking account can technically open.
Confirm Microsoft's fix for the EchoLeak flaw is applied to your tenant, then check the configuration around it. Review how external email is handled during summarization, whether external image and link rendering is permitted in assistant-visible content, and which connectors pull third-party data into the context window. Where the business case for external content ingestion is weak, disable it and require an explicit exception.
Once ingestion paths are tightened, turn to identity. Treat every AI service account, API key and OAuth grant as a privileged identity with an owner, an expiry and conditional access policy attached. Scope tokens to the smallest set of tool calls the agent needs, and make sure someone knows which console revokes each one without a hunt at 2 a.m.
- Enable and centralise audit logging for Copilot and any agentic coding tools, including full prompt and tool-call history, not just authentication events.
- Retain memory stores and tool-call logs long enough to reconstruct a decision chain after the fact.
- Alert on anomalous volumes of agent-initiated queries or API calls from a single agent identity.
- Alert on scope violations, such as an email-summarization agent querying a file share.
- Watch for artifacts the agent creates on its own: scheduled tasks, mailbox forwarding rules, new API keys.
Agent sessions carry legitimate entitlements, so the authentication trail looks clean while the behaviour does not. In environments Capstone manages, Adlumin ITDR baselines authentication and access patterns for service and machine identities across managed environments, which is where an agent identity making requests at machine speed becomes visible as an anomaly.
Over the next quarter, write an AI usage policy that names approved tools and prohibited data classes rather than issuing a blanket ban. Blocking assistants outright pushes staff to personal accounts and unmanaged browser extensions, where you have no logging, no data classification and no ability to revoke anything. An approved-tool list with clear rules on regulated data gives you a surface you can actually monitor.
Run prompt-injection testing against your internal retrieval-augmented deployments before an outsider does. Seed your own document repositories with benign instruction payloads and confirm whether the agent flags them, ignores them or follows them. If the reasoning output shows the agent noticed the instruction and proceeded, you have a guardrail gap. If it never flagged it, you have a detection gap, and the two need different fixes.
Build detection content for high-velocity automated reconnaissance, the enumeration and access patterns that arrive faster than a human operator would produce them. Tune this against your own agent baselines so legitimate automation does not drown the signal.
Finally, rehearse the sequence against a clock. Pick an assistant that touches regulated data, run a tabletop where its identity is compromised, and time how long it takes your team to revoke credentials, freeze the memory store, pull the tool-call log and brief legal on what the agent could reach versus what it did reach. When you restore, re-issue credentials with narrower entitlements than the ones that failed.
The Priority for Organisations Deploying AI Assistants
The common thread in both cases is privilege. An AI agent runs with credentials, API keys and OAuth tokens that carry entitlements no human in an equivalent role would be handed, and with far less scrutiny applied to how those entitlements get used day to day.
Obsidian Security's analysis of the Salesloft-Drift OAuth compromise shows what that concentration produces. One compromised connected app cascaded into hundreds of downstream SaaS environments. Agents are now the things holding those tokens and chaining tool calls across systems on your behalf, so the entitlement scope of a single agent identity sets the outer limit of what any incident involving it can become.
The one action worth prioritising is an inventory. Produce a list of every AI agent operating in your environment, including the ones individual teams stood up on their own, and for each one record what it is registered to do, which identity it authenticates as, and which data stores, APIs and SaaS connections it can reach. Then reduce that reach to what the declared task actually requires.
That mapping is what turns a vague question into an answerable one. When an agent behaves outside its scope, the difference between an hour of confusion and a defensible answer is whether you already know what it could touch. It also determines how quickly you can tell legal and privacy stakeholders whether regulated data was in reach, which shapes your notification obligations.
Governance principles will still matter. The inventory is what makes them enforceable, because you cannot apply least privilege to an agent whose access you have never enumerated.
