Context & Harness Attacks

Microsoft documents a mail-flow layer that detects prompt-injection content in inbound email before delivery to users or AI assistants. Detections land as High confidence phishing with technology "Prompt injection protection" (MDO Plan 2 / E5-class). Focus: instructions that try to exfiltrate via URL, reveal system prompts, or enumerate write-capable tools — including hidden/white-on-white text. Runtime Copilot safeguards remain a second layer. This is harness/context defense at the email channel, not a new CVE.

Rob T. Lee and Indre Altman compared the [un]prompted AI Security Practitioner Conference CFP rounds: 469 submissions in March and 490 in October. Harness-layer attack proposals rose from 12 to 33. 94 submissions used the word 'harness'. 71% of the October pool is agent-native (harness, MCP and skill supply chain, agent identity, prompt injection, agentic-browser attacks). Only 12% carry production evidence. Caveat: this is a CFP census, not incident data. The full report is linked from the conference site; we've only verified the figures quoted in the author's post.

An arXiv paper treating the harness (tool use, context management, state) as the attack surface. It proposes four defense layers: adversarial context filtering, causal verification of decisions, privilege-separated tool control and safe rollback. It reports ~42% lower attack success on benchmarks. Caveat: simulated evaluation, not production evidence.