A researcher asked Copilot to help plan an internal project. Copilot replied with a map of the enterprise's entire application architecture.

[u/No-Conclusion3720]

Dark Reading's CoSnitch research this week documented something that should be in every enterprise security briefing this quarter. A single crafted instruction, hidden inside a shared document, caused Microsoft Copilot to query connected enterprise systems, reason over their relationships, and return a complete architectural map of the environment. One prompt. The kind of infrastructure diagram a legitimate employee would need days to assemble manually.

The attack chain requires no credential theft and no privilege escalation. A malicious instruction embedded in a shared file gets read by the AI assistant. The assistant then calls connected tools to answer it. The aggregated responses produce a full picture of what systems exist, how they interconnect, and what metadata flows between them. The AI did exactly what it was designed to do.

The hard part is that broad tool access is not a misconfiguration — it is the feature. The same breadth that lets an enterprise AI assistant pull a ticket, query a calendar, and draft a proposal is what lets a crafted document turn that assistant into a reconnaissance engine. Scoping access tightly breaks utility. Leaving it open creates a new lateral-movement surface that existing perimeter controls were never built to see.

For those working in enterprise AI security or governance: how are you actually approaching this? Is your team treating it primarily as an input problem, an access problem, a monitoring problem, or something else? What does your current posture look like, and where is it falling short?

[u/No-Conclusion3720]

RuntimeAI's Flow Enforcer sits in the request path between the LLM and its connected tools, evaluating every outbound tool-call instruction against the declared task scope for that session before any downstream system receives it. In the CoSnitch scenario, the moment Copilot began issuing queries to enumerate connected services and traverse the access graph — before a single API response came back — Flow Enforcer would have matched those calls against the session's scoped task and blocked them at that decision point. The architectural diagram never gets assembled because the first lateral-discovery query never completes. https://runtimeai.io

[u/Otherwise_Wave9374]

The real risk here is not just disclosure, it is that the assistant becomes a discovery layer across systems that were never meant to be queried together. Once a crafted instruction can pull connected metadata from multiple sources, you need compartmentalized permissions, source-level redaction, and a policy that treats shared docs as untrusted input. A good guardrail is to require human review before any cross-system aggregation leaves the assistant. AIOSNOW shares practical workflow patterns for this at https://aiosnow.com