Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat
What happened
CSO Online published 10 ways attackers abuse AI services to hack your business, cataloging specific, named attack campaigns against enterprise AI infrastructure. Among the incidents documented: a counterfeit MCP server was distributed while impersonating the legitimate email delivery service Postmark, giving attackers access to any environment that installed it. A backdoor called SesameOp hid attacker command-and-control traffic inside the OpenAI Assistants API, using an AI platform that enterprises trust and monitor poorly. CVE-2025-32711 is a flaw in Microsoft 365 Copilot. It allowed attackers to trigger data theft from a user's mailbox by sending a single crafted email. This is covered in 18 Microsoft AI Vulnerabilities Expose Privilege Escalation Risk in Copilot and Azure. The reporting also identified dependency poisoning in agentic workflows. Attackers corrupt the software libraries that AI agents rely on to take actions. Prompt injection attacks were also identified, redirecting agent behavior mid-task. Together the incidents form a coherent taxonomy of supply chain, identity, and runtime control failures that existing AI governance programs were not designed to catch.
Why it matters
- ·Procurement and vendor due diligence programs were not built to verify MCP server identity or detect counterfeit AI tool packages. Attackers are now specifically targeting the AI tooling supply chain. This means OWASP Top 10 for Large Language Model Applications supply chain controls must extend into the MCP and plugin layer, not just model selection.
- ·CVE-2025-32711 in Microsoft 365 Copilot shows that a widely deployed enterprise AI product can be turned into a data-exfiltration tool with a single malicious email, no user action required. Compliance teams that approved Copilot deployments need to confirm with IT whether this vulnerability has been patched and whether any data-access logs from the period of exposure have been reviewed.
- ·The SesameOp backdoor hid attacker commands inside legitimate OpenAI API traffic. This exposes a gap in vendor incident notification. Most enterprise AI vendor contracts do not require the vendor to alert customers when their platforms are abused as attack infrastructure. Existing vendor oversight controls built for model updates and data handling do not cover this category of abuse.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your IT or security team whether CVE-2025-32711 in Microsoft 365 Copilot has been patched in your environment, and request a review of Copilot data-access logs for any unexplained mailbox queries during the period before the patch was applied.
- ☐Pull a complete list of every MCP server, plugin, and AI tool connector approved or in use across the organization, and verify that each one came from an official, authenticated source rather than a third-party registry or developer-shared package.
- ☐Review your AI vendor contracts and check whether any require the vendor to notify you if their platform is used as attack infrastructure by a third party. Flag any contract that lacks this requirement for renegotiation or supplemental agreement.
- ☐Confirm with your security team whether outbound traffic from AI agents and API integrations is monitored. The SesameOp backdoor worked precisely because AI API traffic is trusted and largely unwatched: ask whether your monitoring tools can distinguish normal AI API calls from covert command traffic.
- ☐Add MCP server identity verification and AI tool supply chain provenance to your next vendor due diligence cycle. Specifically ask vendors: how do you authenticate tool packages before they are made available for installation, and what controls prevent impersonation of trusted services like Postmark?
What to watch next
Microsoft has not yet confirmed whether CVE-2025-32711 triggered breach notification obligations under the EU AI Act (Regulation (EU) 2024/1689). It is also unclear whether national data protection laws impose obligations for affected enterprise customers. Compliance teams should monitor whether regulators treat AI platform vulnerabilities exploited via a single email as notifiable security incidents. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services is expected to be updated as MCP-specific attack patterns mature. Named incidents are growing in number, from the Postmark impersonation to SesameOp to the 253 MCP Server Bugs and Six Framework Bypasses reported earlier this year. This trend suggests regulators and auditors will soon treat MCP server inventory and plugin verification as baseline expectations, not optional hardening.