# The next layer of AI security

DevFeed: [The next layer of AI security](<https://devfeed.tech/articles/the-next-layer-of-ai-security-1901.md>)

Original publisher: [Read original article](<https://1password.com/blog/ai-security-runtime-controls>)

Author: info@1password.com (Jacob DePriest; Nancy Wang; Jeff Malnick)

Published: 2026-03-19T00:00:00Z

Content type: article

Language: en

Sources: [Blog on 1Password Blog](<https://devfeed.tech/sources/blog-on-1password-blog.md>)

Topics: [AI Bots](<https://devfeed.tech/topics/ai-bots.md>), [AI Chat](<https://devfeed.tech/topics/ai-chat.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-security](<https://devfeed.tech/tags/ai-security.md>), [developers](<https://devfeed.tech/tags/developers.md>), [microsoft-365-copilot](<https://devfeed.tech/tags/microsoft-365-copilot.md>), [security](<https://devfeed.tech/tags/security.md>), [unified-access](<https://devfeed.tech/tags/unified-access.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article examines prompt injection risks in AI agents that act with user-level permissions. Using the EchoLeak vulnerability in Microsoft 365 Copilot as an example, it argues that correct authentication and authorization do not prevent unsafe actions after access has been granted.

## Source excerpt

Identity establishes trust. The next problem is how that trust is used. In June 2025, Microsoft patched EchoLeak (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot that allowed an attacker to exfiltrate sensitive enterprise data, including API keys, confidential documents, and internal conversation snippets, without human intervention. The attack was deceptively simple. An attacker sent a normal-looking email with hidden instructions embedded in it. A human would not notice them, but the model could interpret them. The email remained dormant until Copilot later pulled it into context for another task. At that point, the instructions triggered, and the agent used the victim's existing permissions to retrieve and disclose sensitive information. The specific vulnerability matters, but the broader lesson matters more. A system can authenticate correctly, authorize correctly, and still produce the wrong outcome. Microsoft patched EchoLeak before it was publicly disclosed. Since then, researchers have identified similar patterns across AI-assisted workflows, including additional Copilot-related vulnerabilities in 2026. These are not isolated issues. They point to a broader, repeatable pattern. When AI systems process untrusted content and act with user-level permissions, prompt injection and unintended data access become systemic risks rather than edge cases. This is not a failure of authentication or authorization. It is what happens after both succeed. Systems are behaving exactly as designed, and still producing the wrong outcomes. Prompt injection breaks the execution model Prompt injection isn't just a model issue. It's a signal that something is breaking between how systems reason and how they act. The industry sees the same thing. OWASP Top 10 for LLM applications ranks prompt injection as a primary attack vector, and research from OpenAI and others shows that models cannot reliably distinguish between legitimate instructions and malicious ones e