Trust is a legacy variable.
I first applied that phrase to smart contract upgradeability in 2024, while auditing a DeFi protocol whose "immutable" vault logic was stored behind a four-of-seven multisig that could swap the implementation in eleven minutes. Code was not the trust anchor. The governance keys were. Rubrik Zero Labs' Black Hat USA 2026 disclosure forces a broader reading. The legacy variable is not the contract behind the proxy; it is the session inherited by an AI agent's execution environment.
Researchers Ori Lahav and Dan Avraham presented a vulnerability class they call Remote Prompt Execution (RPE) against Microsoft 365 Copilot. A single Word document, opened by an unsuspecting user, triggers a five-stage chain: an embedded prompt injection, a safety-guardrail bypass, sandbox privilege escalation, a path traversal in Azure Container Apps dynamic sessions, and an LD_PRELOAD escape into the host operating system. The tracked vulnerability, CVE-2026-32193, is a CWE-22 path traversal in Azure Kubernetes Service with a CVSS score of 8.8; Microsoft awarded $48,000 through its bug bounty program before patching it in the June 2026 security update. The certificate is almost beside the point.
Code does not lie, but it can be misled. The specific flaw is patched. The exploit class is not. This research lands at an awkward moment for me: I have spent the past two years designing economic incentive layers for AI-agent-to-agent transactions on Layer 2 networks. That framework assumes the agent's execution environment can be treated as a trusted boundary. RPE says it cannot. The boundary was never the sandbox; the boundary was the user's session — and the session, as it turns out, inherits everything.
The research, published through Rubrik Zero Labs' technical blog by Kyle Fiehler on July 30, 2026, documents a live demonstration at Black Hat. Lahav and Avraham call their proof-of-concept ChatMate, and they frame it explicitly as a demonstration of a technique class rather than an active in-the-wild exploit. That distinction matters for vendor liability, but it matters less for security architecture — because the architecture under attack is not unique to Microsoft. Any AI assistant that relies on containerized execution environments processing user requests — session-level interpreters, dynamic containers, sandboxed code runtimes — carries the same conceptual exposure. The blog is also careful to note that the underlying vulnerability was reported to Microsoft and fixed before public disclosure. Textbook coordinated disclosure, and worth acknowledging in an industry where too many AI security findings are released as marketing artifacts.
The five stages deserve a precise walkthrough, because the composition is what separates RPE from yet another prompt injection write-up. Stage one is document upload. The attacker plants hidden white-on-white text inside a Word file; the human eye sees a blank page, while the LLM's tokenizer sees instructions. Stage two is the guardrail bypass: the injection is engineered to defeat Microsoft's safety classification layers, which operate as statistical filters rather than deterministic access controls. Stage three is privilege escalation within the Copilot sandbox — the attacker's prompts execute with elevated capability, mapped directly to the user's enterprise identity. Stage four is the named vulnerability: a path traversal (CWE-22) in Azure Container Apps dynamic sessions, targeting the ACA-Session-Interpreter. Stage five is the LD_PRELOAD exploitation — loading a malicious shared object into the container's runtime — which collapses the sandbox boundary entirely.
Each stage is independently forgettable. Prompt injection is a known tax on LLM products. Path traversal is CWE-22, the second entry in the Common Weakness Enumeration catalog. LD_PRELOAD has been a privilege escalation primitive since the early 1990s. The contribution of RPE is the chain itself — the transformation of a routine file transfer into a machine-level foothold.
The end state of that chain is a bidirectional, persistent, interactive shell — not a one-shot injection that exfiltrates a single data point. The attacker injects prompts into the victim's live assistant session and reads back responses in real time. Because the session inherits the user's identity, the attacker operates with the user's permissions across M365, Azure, and every connected enterprise data source. Data exfiltration becomes a continuous stream. Persistence becomes a configuration change. All of it is triggered by a single document upload from a user who will never see an error message. RPE converts the assistant into a proxy for the user's entire digital identity.
I have seen the difference between a bug inside a function and a bug in an architecture's composition. In the summer of 2020, auditing the bZx v3 smart contracts as an undergraduate, I identified an integer overflow in the flash loan repayment logic — a single arithmetic fault that would have allowed an attacker to drain liquidity pools. It was reported, rewarded with a $2,500 bounty, and fixed before exploitation. That was a bug in a function. RPE is a bug in an assumption. The assumption is that the sandbox's authority boundary can be drawn independently of the user's identity boundary. The bZx vulnerability required a sophisticated attacker who understood DeFi primitives; RPE requires only the opening of a file. The severity difference is not in the CVSS score. It is in the access economics: the cost of entry dropped from exploit developer to phishing operator with a malicious document.
Rubrik's framing — the chain is the threat, not any individual step — is a useful corrective to the vulnerability management theater that follows every high-profile disclosure. Security teams will patch CVE-2026-32193, verify the patch, and close the ticket. Meanwhile, the chain persists because each link in it is independently considered acceptable risk: prompt injection is a product risk to be managed; guardrail bypass is a model risk to be monitored; path traversal is an infrastructure risk to be patched; LD_PRELOAD is a container risk to be mitigated. The compartmentalization of these findings is precisely what makes composition attacks viable. No single team owns the chain. Therefore, no single team can see it forming.
RPE did not materialize in a vacuum. It closes a summer of accelerating disclosures in agentic infrastructure, and the pattern shows the attacker economy shifting toward AI tooling as a primary target. CVE-2026-9198, an unauthenticated remote code execution flaw in IBM Langflow's default configuration, triggered an emergency deadline from CISA. CVE-2026-33017, another Langflow vulnerability, was weaponized within twenty hours of public disclosure. CVE-2026-55255, an IDOR in the same platform, was used to harvest LLM provider keys and cloud credentials. Unit 42 documented autonomous attack campaigns where threat actors intentionally selected DeepSeek as their target model because its safety guardrails were the least restrictive among available alternatives. Attackers are treating LLM safety posture as a selection variable — a rational economic choice. The common thread is that agent infrastructure has become the attack surface, and the model's safety features are, at best, a speed bump. RPE adds a vector that does not merely prompt a model to do something harmful; it uses the model's own execution capabilities to reach underneath the model entirely.
For the crypto industry, the timing is uncomfortable. We are in a bull market narrative cycle where autonomous agents are the new user acquisition channel: agents holding wallets, agents executing trades, agents paying for compute, agents negotiating with other agents. My current research position — Layer 2 research lead — involves building the economic incentive framework for exactly these interactions: pricing micro-transactions of computational power and data validation on L2 networks, modeling gas mechanics, and ensuring that autonomous agents can pay for blockchain storage and computation without human intervention. RPE throws a variable into that model that my spreadsheets never accounted for: the agent's execution environment is compromised at a level below the protocol.
Let me make the threat concrete. An autonomous trading agent on an L2 executes a micro-transaction: it signs a transfer with a session-scoped key, or it calls a smart contract that has been granted approval for a limited budget. The agent's container is hijacked via a path traversal; the attacker injects a prompt into the agent's context. The agent, believing it is acting on legitimate instructions, signs the transaction. The signature is valid. The transaction is final. The settlement layer processed everything correctly. The protocol did not fail; the code did not lie. The agent was misled — and the entire economic value it controlled was transferred to the attacker. In enterprise AI, the session inherits the user's identity; in agentic crypto, the session inherits the agent's keys. Same architecture. Same failure. The difference is that in crypto, finality is immediate and irreversible. There is no clawback, no incident response window that matters after settlement. The exploit economics are better for the attacker: one compromised container, one valid signature, one irreversible transfer.
The bridge post-mortem I led in 2025 should have prepared me for this. After the cross-chain bridge exploits during the regulatory crackdown, I spent months dissecting the signature verification flaws in three major bridges' multichain consensus layers. The quantitative loss was $400 million. The qualitative lesson was simpler: the smart contracts were audited repeatedly and passed; the weakest link was the centralized multi-sig wallets that held operational authority. Technical decentralization was irrelevant when operational security failed. My report, cited by EU regulators in the MiCA implementation guidelines, argued that the industry needed to stop treating trustless as a binary property and start measuring the actual trust surface: the keys, the governance, the operational infrastructure. RPE is the same lesson, one abstraction layer up. The audited smart contract becomes the audited LLM; the multi-sig becomes the session; the private keys become the user's identity. The attacker does not need to break the cryptography; they need to break the assumption that the authority boundary is where the architecture drawing says it is.
The crypto-native response to RPE will predictably involve zero-knowledge proofs. ZK-circuits are compressing the future; proving systems can attest that a computation was performed correctly, that state transitions were valid, that the model executed within its rules. But a proof of correct execution is not a proof of correct input. An LLM running in an attested enclave proves that the inference was computed. It does not prove that the prompt came from the user rather than an attacker who injected it through a malicious document. At the seam where RPE operates, the attacker's instruction is already inside the trusted environment, indistinguishable to any remote verifier. ZK verification works on the arithmetic; it does not reach the semantics. Cryptographic attestation cannot distinguish "user asked the agent to transfer 100 USDC" from "attacker injected a prompt instructing the agent to transfer 100 USDC." The proving system validates the arithmetic, not the source. You cannot prove away a prompt you cannot identify.
The same mythology that surrounds trustless systems in crypto is now being applied to enterprise AI. Microsoft's marketing materials frame Copilot as an assistant that operates within the organization's security boundaries. Rubrik's research demonstrates that the boundary dissolves the moment a document containing white-on-white text passes through the ingestion pipeline. The operational security lesson from my 2022 L2 scalability analysis applies here directly: when I reverse-engineered the fraud-proof mechanisms of Arbitrum and Optimism, I found that their calldata compression strategies were inefficient for large institutional transfers — the architecture, not the tokenomics, determined the real cost. In AI infrastructure, the architecture — not the safety label, not the audit badge — determines the real risk. RPE is not a Microsoft failure; it is an industry callback to the lesson DeFi learned between 2020 and 2025: the trust anchor is never where the whitepaper says it is.
The attack economics drive the likelihood calculus, and they are brutal. A malicious Word document is a commodity; the marginal cost of producing a hidden-text injection file is effectively zero. The expected value on the other side — access to an enterprise session with M365 and Azure permissions — runs to millions of dollars, depending on the tenant's provisioning. Even at a one percent success rate, a bulk phishing campaign targeting thousands of internal users is a rational bet. The attacker does not need the chain to work every time. It needs to work once. That asymmetry is precisely what made cross-chain bridge attacks so profitable: single points of compromise in centralized components, defended by the assumption that no one would target them. The countermeasures also have an economic logic. Minimal-privilege sessions that require human re-authentication for sensitive actions collapse the value of a session compromise. Cryptographic binding of each prompt to a verified user gesture forces the attacker to achieve a second compromise after the injection. For on-chain agents, hardware-backed signers with domain-separated confirmation per amount and counterparty turn a hijacked agent into a limited nuisance rather than a full treasury drain. These are standard key-management practices, applied to an execution environment that never anticipated hostile input at the context level.
The conventional response to RPE will be a cascade of defensive programming: better input sanitization, stronger guardrails, more rigorous sandbox confinement, faster patching. All of it is necessary. None of it addresses the actual vulnerability class. The actual vulnerability class is inheritance — the architectural decision that an AI session should carry the user's full authority, or that an agent's key should map directly to its context. If I apply my bridge audit experience to this problem, the lesson is unambiguous: you can write a perfect smart contract, and it will still be exploited through the keys you least protected. The enterprise industry will invest in guardrails, classifiers, and adversarial training. The exploit will continue to work — not because prompt injection is undefeatable, but because the attacker's real objective is the underlying session boundary, not the model's behavior. Fixing the LLM is like fixing the teller while the vault door is chained to the bank's mailroom.
There is also a regulatory dimension the industry has not fully absorbed. Most DAOs have the legal status of no legal status; when things go wrong, members face unlimited personal liability. The enterprise AI estate is converging on the same structural ambiguity: when Copilot's session is hijacked and enterprise data is exfiltrated, who is liable? The vendor patches the container traversal; the enterprise is left holding the data breach notification, the regulatory fine, and the user who opened the file. The legal framework has not caught up to the technical architecture.
The deeper blind spot is more uncomfortable. RPE works because the model cannot distinguish between a legitimate instruction and an attacker's prompt. This is not a bug awaiting a patch; it is a property of the technology class. LLMs are instruction followers. The entire category is defined by turning textual instructions into actions. If you embed in the product design the ability for a human to instruct an AI assistant, you have simultaneously created the mechanism by which an attacker's instruction reaches the same assistant. The security boundary must therefore exist at the session level, not the model level. Every architecture that assumes otherwise is accumulating technical debt that RPE will collect with interest. Consider the structural imbalance in the vendor relationship: AI platform providers control the sandbox, the session, and the patch cadence; enterprises control the users, the data, and the liability. Accountability for a chain — as opposed to a component — is a governance question, and governance questions are exactly the ones most technical teams defer.
The RPE class will not be patched away. It will be migrated away — if we do the work. The patchable artifact was one path traversal in Azure's container session management. The persistent artifact is the inheritance model that grants conversational AI the privilege of its users and grants autonomous agents the authority of their wallets. As I build the next generation of on-chain agent economies, the design constraint is no longer efficiency; it is provenance, minimal privilege, and prompt authentication at every boundary. A document upload can become a shell. The shell inherits everything the user can see. And the user, increasingly, holds keys to infrastructure that moves value.
Trust is a legacy variable. In 2026, that variable is inherited by machines that read untrusted input. ZK-circuits are compressing the future — but they are not compressing the attack surface. The question for architects and auditors alike is whether we can build sessions that survive their agents' compromise, and whether we are willing to measure trust not by the claims in a whitepaper but by the boundaries in a system diagram. The document is uploaded. The chain is waiting. The question is whether you have already built the session that can contain it.
