{
  "schemaVersion": "1.0",
  "kind": "attack-path",
  "title": "A Copilot attack path worth testing",
  "status": "THREAT_MODEL_HYPOTHESIS",
  "paper": {
    "title": "Security and Privacy Implications of Microsoft 365 Copilot and GenAI Integration in Enterprise Environments",
    "doi": "10.11648/j.ajist.20261002.11"
  },
  "stages": [
    {
      "id": "untrusted-content",
      "label": "Untrusted instructions enter content Copilot can reach",
      "examples": ["prompt", "email", "file", "chat"],
      "sourceClaims": ["background-001", "results-001"]
    },
    {
      "id": "cross-app-retrieval",
      "label": "Copilot retrieves cross-application context",
      "examples": ["email", "files", "chats", "calendars"],
      "sourceClaims": ["background-001", "figures-001"]
    },
    {
      "id": "model-steering",
      "label": "The model may follow the instruction or combine protected context",
      "sourceClaims": ["results-001"]
    },
    {
      "id": "permission-reach",
      "label": "Existing Microsoft 365 permissions determine the reachable data",
      "sourceClaims": ["results-001", "practice-001"]
    },
    {
      "id": "exposure",
      "label": "Generated output or an action may expose sensitive data",
      "sourceClaims": ["background-001", "results-001"]
    }
  ],
  "controlPoints": [
    {
      "label": "Source trust and prompt or context validation",
      "sourceClaims": ["practice-001"]
    },
    {
      "label": "Least privilege, role-based access control, Purview and data loss prevention",
      "sourceClaims": ["question-001", "results-001", "practice-001"]
    },
    {
      "label": "Prompt, context and output logging with human approval where needed",
      "sourceClaims": ["practice-001"]
    },
    {
      "label": "Tenant isolation and cross-application data-flow review",
      "sourceClaims": ["figures-001", "practice-001"]
    }
  ],
  "limitations": [
    "The researchers did not run live attacks or inspect proprietary tenant data.",
    "The review cannot establish attack frequency, success rate or control effectiveness in a specific tenant.",
    "Use the path to form testable hypotheses, not as evidence that a deployment is exploitable."
  ]
}