---
title: Context & Harness Attacks | ctxsec
url: https://ctxsec.com/context
---

# Context & Harness Attacks

Prompt injection, MCP and skill supply chain, agent identity, agentic-browser attacks and sandbox escapes: the layer around the model.

confirmed (vendor)

2026-10-13

### Defender for Office 365: prompt-injection protection quarantines high-confidence email before Copilot sees it

Microsoft documents a mail-flow layer that detects prompt-injection content in inbound email before delivery to users or AI assistants. Detections land as High confidence phishing with technology "Prompt injection protection" (MDO Plan 2 / E5-class). Focus: instructions that try to exfiltrate via URL, reveal system prompts, or enumerate write-capable tools — including hidden/white-on-white text. Runtime Copilot safeguards remain a second layer. This is harness/context defense at the email channel, not a new CVE.

Sources: [Microsoft Learn: Prompt injection protection](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/prompt-injection-protection-defender-for-office-365) · [Microsoft Learn: Copilot prompt defense in depth](https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-prompt-defense-in-depth)

confirmed (author's post)

2026-10-13

### State of AI Cybersecurity: harness-layer attack proposals up 175% (12 → 33), March to October

Rob T. Lee and Indre Altman compared the [un]prompted AI Security Practitioner Conference CFP rounds: 469 submissions in March and 490 in October. Harness-layer attack proposals rose from 12 to 33. 94 submissions used the word 'harness'. 71% of the October pool is agent-native (harness, MCP and skill supply chain, agent identity, prompt injection, agentic-browser attacks). Only 12% carry production evidence. Caveat: this is a CFP census, not incident data. The full report is linked from the conference site; we've only verified the figures quoted in the author's post.

Sources: [Rob T. Lee on X](https://x.com/robtlee/status/2110127235349008754) · [[un]prompted conference](https://unpromptedcon.org)

research (benchmark, not production)

2026-04-15

### SafeHarness: defenses built into the agent harness lifecycle

An arXiv paper treating the harness (tool use, context management, state) as the attack surface. It proposes four defense layers: adversarial context filtering, causal verification of decisions, privilege-separated tool control and safe rollback. It reports ~42% lower attack success on benchmarks. Caveat: simulated evaluation, not production evidence.

Sources: [arXiv 2604.13630](https://arxiv.org/abs/2604.13630) · [Code](https://github.com/liu-yang-maker/SafeHarness)