The model isn't the perimeter.

Prompt injection isn't a vulnerability class

What actually happens when you deploy a Copilot agent

The guardrail layer is thinner than you think

Every agent framework ships with a system prompt that says "you are a helpful assistant." The attack surface starts in the sentence nobody reads.

Most red-team reports on LLM-based applications test the model. They send adversarial prompts, observe the output, and file findings. This misses the point. The model is a component. The application around it — retrieval, tool calls, output parsing, session management — is where the exploitable logic lives. If you only test the model, you're pen-testing the CPU instead of the app.

Archive  ·  About  ·  Subscribe

CVE-2024-38109  ·  CVSS 9.1  ·  Copilot Studio  ·  SSRF → full tenant compromise

SEVERITY    VECTOR    AFFECTED PRODUCT    READING TIME

2025-09-12  ·  8 min read  ·  ai-security, red-team