Enterprise AI Agents’ Cyber Capabilities Make Governance and Access Controls Critical
Summary
Examples involving Copilot, Slack AI, GitHub workflows and coding agents show how trusted AI systems can expose data or alter production systems. The article argues for least privilege, independent monitoring and deterministic authorization.
Key points
- Prompt injection demonstrations involving Microsoft 365 Copilot, Slack AI and Salesforce Agentforce showed how malicious content could influence agents to disclose data available through their existing access; vendors reported fixes or safeguards.
- Researchers reported that GitHub Agentic Workflows could retrieve private-repository content after processing instructions in a public issue.
- The article describes coding-agent incidents involving reported production database or service disruptions, including cases where agents had credentials and tools capable of making consequential changes.
- The examples illustrate how untrusted input combined with trusted identities and excessive permissions can make agent activity difficult to distinguish from legitimate automation.
- The article recommends narrowly scoped identities and tools, independent logs, monitoring, network and egress controls, and deterministic authorization outside the AI agent.
- It recommends human approval or additional policy controls for high-impact actions, while noting that governance should address an agent’s actual capabilities, permissions and autonomy.
Article Details
- Topic
- Governance and security risks of enterprise AI agents with privileged access
CVE
CVE-2025-32711One of the clearest examples is EchoLeak (CVE-2025-32711), disclosed in 2025 against Microsoft 365 Copilot. Researchers demonstrated that a crafted email could introduce malicious instructions into Copilot's context andCVE-2025-53773The same principle can extend from data access to code execution. CVE-2025-53773, affecting GitHub Copilot and Visual Studio, showed that prompt injection could lead to local command execution. Security researcher
People
Vendors
Amazon Web ServicesThe same problem has appeared at much larger scale. In February 2026, Reuters reported that AWS had experienced a 13-hour interruption to a cost-management system in December 2025 after engineers allowed its Kiro codingGitHubA particularly direct example appeared in July 2026 with GitLost, research against GitHub Agentic Workflows. Researchers demonstrated a workflow that processed issues from a public repository while also having readMcKinseycompany CodeWall reported that its autonomous security agent identified and exploited vulnerabilities in McKinsey's internal generative AI platform, Lilli, obtaining read and write access to its production database inMicrosoftMicrosoft 365 CopilotRailwaypowered by Claude Opus 4.6 deleted the company's production database and volume-level backups through a Railway API operation while working on a task intended for staging. Reporting on the incident describes the agentReplitIn July 2025, SaaStr founder Jason Lemkin reported that Replit's AI Agent deleted a production database during an explicit code freeze, affecting records for more than 1,200 executives and companies. Replit's CEOSalesforceSalesforce Agentforce
Products
Claude Opus 4.6And in April 2026, the founder of PocketOS reported that a Cursor coding agent powered by Claude Opus 4.6 deleted the company's production database and volume-level backups through a Railway API operation while workingCursorAnd in April 2026, the founder of PocketOS reported that a Cursor coding agent powered by Claude Opus 4.6 deleted the company's production database and volume-level backups through a Railway API operation while workingGitHub Agentic WorkflowsA particularly direct example appeared in July 2026 with GitLost, research against GitHub Agentic Workflows. Researchers demonstrated a workflow that processed issues from a public repository while also having readGitHub CopilotThe same principle can extend from data access to code execution. CVE-2025-53773, affecting GitHub Copilot and Visual Studio, showed that prompt injection could lead to local command execution. Security researcherKiroa 13-hour interruption to a cost-management system in December 2025 after engineers allowed its Kiro coding agent to make changes and, according to the underlying Financial Times reporting, the agent decidedLillisecurity agent identified and exploited vulnerabilities in McKinsey's internal generative AI platform, Lilli, obtaining read and write access to its production database in roughly two hours. McKinsey independentlyMicrosoft 365 CopilotOne of the clearest examples is EchoLeak (CVE-2025-32711), disclosed in 2025 against Microsoft 365 Copilot. Researchers demonstrated that a crafted email could introduce malicious instructions into Copilot's context andSalesforce AgentforceIn 2025, researchers demonstrated a similar pattern against Salesforce Agentforce in a vulnerability chain it called ForcedLeak. Malicious instructions could be planted in a Web-to-Lead submission and later enter anSlack AIA related 2024 demonstration against Slack AI showed how the same trust problem can appear inside collaboration platforms. Researchers showed that malicious instructions placed in content Slack AI could retrieve couldVisual Studioprinciple can extend from data access to code execution. CVE-2025-53773, affecting GitHub Copilot and Visual Studio, showed that prompt injection could lead to local command execution. Security researcher Johann