Look at the AI security incidents of 2025 and 2026 and one fact stands out: in almost none of them did anyone attack the model. EchoLeak (CVE-2025-32711) exfiltrated corporate data through Microsoft 365 Copilot's email-retrieval pipeline with zero clicks. PoisonedRAG showed that five malicious documents in a 2.6-million-document store could control a frontier model's output ~97% of the time. MCP servers were taken over through missing authentication (nginx-ui, CVSS 9.8) and command injection (LiteLLM, added to the federal CISA exploited-vulnerabilities catalog).[1][2][3] The model weights were never the target. The harness was — the retrieval, the tools, the memory, the connectors, the plumbing. IBM found shadow AI adds $670K to the average breach and that 63% of organizations have no AI governance at all.[4] The cost of the harness is not just performance. It is an attack surface nobody put on the balance sheet.
There is a useful heuristic in AI engineering that the model is only a fraction of an agentic system — the harness around it (tools, retrieval, memory, connectors, orchestration) does most of the work. It is a rule of thumb, not a measured statistic, and it is not, despite the meme, a published Google figure.[6] But run it through a security lens and it stops being a heuristic. If the harness is where the work happens, the harness is where the attacks happen. And they do.
EchoLeak (CVE-2025-32711, disclosed June 2025) was the proof: a crafted email caused Microsoft 365 Copilot to exfiltrate data from its own context — chat history, OneDrive, SharePoint — with no user click, by exploiting the retrieval-and-rendering pipeline, not the model.[1] The researchers called it an LLM scope violation; the vector was the plumbing. Microsoft rated it 9.3 Critical (NVD rated it 7.5). PoisonedRAG, presented at USENIX Security 2025, showed the same principle in the knowledge base: inject five malicious documents into a 2.6-million-document store and control the model's answer ~97% of the time.[2] The weights were untouched. The retrieval layer did the damage.
By 2026 the pattern had a CVE trail. The nginx-ui MCP endpoint could be taken over in two requests through missing authentication (CVE-2026-33032, CVSS 9.8); LiteLLM's MCP command-injection flaw was added to the federal CISA Known Exploited Vulnerabilities catalog; a self-propagating worm hit 73 Microsoft GitHub repositories via AI-coding-tool config files.[3] OWASP has ranked prompt injection the number-one risk on its LLM Top 10 for two consecutive editions, and CrowdStrike's 2026 threat report put it plainly: prompts are the new malware, with attackers exploiting AI tools at more than 90 organizations.[5] Every one of these is an attack on the scaffolding, not the intelligence.
The honest limits. Most of these are CVEs and researcher demonstrations with responsible disclosure — the attack-the-plumbing thesis is proven in the lab and by vulnerability, but public evidence of a named Fortune-500 victim breached this way is still thin (and one widely-circulated claim of a $20 autonomous-agent hack of a major consultancy could not be verified and is excluded here). Prompt injection itself remains, in the words of OpenAI's own security chief, a frontier, unsolved problem.[5] The cost is real and rising — Gartner projects enterprises spend 17x more on AI-security tools than on securing AI itself — but this is a diagnosis of an attack surface, not a body count. The point is where the surface is: not the model, the harness.
Five documents, no access to the model, ~97% control of its answers.[2] The attack did not need the weights, the training data, or the API keys. It needed the retrieval layer — the part of the harness nobody was defending.
Two years of AI breaches in which the model was never the target — only the plumbing around it.
CVE-2025-32711: a crafted email makes Microsoft 365 Copilot exfiltrate data from its own context — no click — by exploiting the retrieval-and-rendering pipeline, not the model. The first production zero-click LLM data-exfiltration. Microsoft rated it 9.3 Critical.[1]
The ProofAt USENIX Security 2025, researchers show that injecting five malicious documents into a 2.6-million-document knowledge base controls a frontier model's output ~97% of the time. OWASP adds vector-and-embedding weaknesses to its LLM Top 10. The knowledge base is the weapon.[2]
The Retrievalnginx-ui's MCP endpoint falls to missing auth (CVE-2026-33032, CVSS 9.8, exploited); LiteLLM's MCP command-injection flaw is added to the federal CISA exploited-vulnerabilities catalog; a self-replicating worm hits 73 Microsoft GitHub repos through AI-tool config files.[3]
The ToolsCrowdStrike's 2026 Global Threat Report: prompts are the new malware, with adversaries exploiting AI tools at more than 90 organizations. Prompt injection holds the number-one spot on OWASP's LLM Top 10 for a second consecutive edition — and remains, per OpenAI's CISO, unsolved.[5]
NamedIBM: shadow AI adds $670K to the average breach; 63% of organizations have no AI governance. Gartner projects enterprises spend 17x more on AI-powered security tools than on securing AI itself — the harness is defended last and least.[4]
The BillPrompts are the new malware. — CrowdStrike, 2026 Global Threat Report, February 24, 2026
| Dimension | Evidence |
|---|---|
| Operational (D6) Origin · 88 | The lever is the execution environment: the harness of retrieval, tools, memory and connectors around the model is the attack surface. EchoLeak exploited the email-retrieval pipeline; PoisonedRAG the knowledge base; the MCP CVEs the tool endpoints.[1][2][3] D6 is the origin because in every case the model behaved exactly as designed — the breach came from the operational scaffolding built to make it useful, which is the part that grows with every integration and is defended least.The Harness Surface |
| Regulatory (D4) L1 · 80 | The standards bodies moved to the harness. OWASP ranked prompt injection number one on its LLM Top 10 for two editions and added vector-and-embedding weaknesses; CISA added MCP command-injection CVEs to its exploited-vulnerabilities catalog; IBM found 63% of firms have no AI governance.[3][4][5] D4 amplifies from D6 because the institutional response is the clearest signal that the surface is real: regulators and standards catalogs do not add categories for hypothetical attacks.The Standards Response |
| Revenue (D2) L1 · 76 | The cost of the harness attack surface is real and unaccounted. IBM: shadow AI adds $670K per breach, global average breach $4.44M; Gartner: AI-security spend ~$51.3B in 2026, yet enterprises spend 17x more on AI-security tools than on securing AI itself.[4][7] D2 amplifies alongside D4 because the security of the harness was priced at approximately zero when the AI budget was drawn — the case's core claim is that this is a line item that exists whether or not it was ever budgeted.The Unbudgeted Cost |
| Customer (D1) L2 · 74 | Enterprise exposure is the customer-facing consequence: every organization that connected a model to its data through a harness inherited that harness's attack surface. 13% of organizations reported breaches of their own AI apps, 97% of them lacking proper access controls.[4] D1 is where the surface becomes a trust problem — the buyer that adopted AI for productivity also adopted a new class of exposure, and the more the model is integrated into real systems, the larger the door it opens. |
| Quality (D5) L2 · 72 | The standing quality defect is that prompt injection is unsolved. OpenAI's CISO calls it a frontier, unsolved problem; Simon Willison, who coined the term, notes there is no reliable mechanism to mark token privileges — instructions and data cannot be cleanly separated in a system built to blend them.[5] D5 is where the surface becomes structural rather than incidental: this is not a bug to be patched but a property of how the harness feeds the model, which is why it holds the OWASP number-one spot year over year. |
| Employee (D3) 62 | D3 is the longest-lag dimension: the security workforce racing an attack surface that grows with every new integration. Gartner projects AI applications will drive 50% of cybersecurity incident-response effort by 2028, and 25% of GenAI apps will see 5+ incidents a year.[7] D3 is slow because defense follows exposure — the tools, playbooks and skills to secure agentic harnesses are being built after the harnesses shipped, which is the gap this case says the balance sheet never funded.Watch — The Race |
The cascade originates in D6 — Operational — because the lever is the execution environment: the harness of tools, retrieval, memory and connectors that surrounds the model is where the attack surface lives, not in the weights.[1][2][3] From D6 it amplifies into D4 (the regulatory/standards response — OWASP ranking prompt injection number one, CISA adding MCP CVEs to its catalog, IBM's governance findings) and D2 (the unbudgeted cost — the 17x AI-security spend imbalance, the $670K shadow-AI breach premium) together, then D1 (enterprise exposure and trust) and D5 (the standing quality problem: prompt injection is unsolved). D3 (the security workforce racing the surface) is the longest-lag dimension. Cross-references: [UC-083] is the prognostic that tracks this escalation; [UC-230] is the defensive-security counterpart; [UC-251] is the cluster this belongs to — the harness is the security line of the AI bill nobody costed. The honest hedge is stated: these are largely CVEs and demonstrations; the 90/10 figure is a heuristic, not a Google statistic; the McKinsey claim is unverified and excluded.
-- UC-253: Nobody Touched the Model: 6D Diagnostic Cascade
-- The security cost hiding in the harness (cluster: UC-251/252/254/255; cyber: UC-083/230)
FORAGE nobody_touched_the_model
WHERE attack_surface_is_harness = true
AND model_weights_untouched = true
AND cost_unbudgeted = true
ACROSS D6, D4, D2, D1, D5, D3
DEPTH 3
SURFACE nobody_touched_the_model
DIVE INTO plumbing_attack_surface
WHEN retrieval_tools_memory_exploited = true
AND prompt_injection_unsolved = true
TRACE harness_attack_cascade
EMIT nobody_touched_the_model_signal
DRIFT nobody_touched_the_model
METHODOLOGY 84
PERFORMANCE 48
FETCH nobody_touched_the_model
THRESHOLD 1000
ON EXECUTE CHIRP high 'EchoLeak exfiltrated data through Copilot's email pipeline, PoisonedRAG controlled outputs with 5 documents, MCP servers fell to missing auth - nobody attacked the model, they attacked the harness around it, and that attack surface is the cost nobody put on the AI balance sheet'
SURFACE analysis AS jsonRuntime: @stratiqx/cal-runtime · Spec: cal.semanticintent.dev · DOI: 10.5281/zenodo.18905193
EchoLeak went through the email pipeline; PoisonedRAG through the knowledge base; the MCP CVEs through missing auth on the tool layer.[1][2][3] Not one of the marquee AI breaches attacked the model itself. The intelligence was fine; the scaffolding was open. You cannot secure a system by securing only its smartest 10%.
Each tool, connector, retrieval source and memory store you bolt onto a model is a new door. The harness that makes the agent useful is the same harness that makes it exploitable — which is why prompt injection is, in OpenAI's own words, an unsolved frontier problem: you cannot fully separate instructions from data in a system built to blend them.[5]
Shadow AI adds $670K per breach; 63% of firms have no AI governance; enterprises spend 17x more on AI-security tools than on securing AI itself.[4] The harness was costed for performance and latency. Its security was costed for approximately nothing — which is exactly why it is where the breaches land.
The honest boundary: these are CVEs and reproducible demonstrations, not a wall of named Fortune-500 victims — and a viral $20-agent-hacks-a-consultancy claim could not be verified and is left out. This is a diagnosis of where the attack surface is, argued from vulnerabilities and research, not inflated with a catastrophe that has not been confirmed.
Seven sources: the verified incidents (EchoLeak CVE, PoisonedRAG USENIX paper, the MCP CVE wave, the Miasma worm), the institutional rankings (OWASP, CrowdStrike, the unsolved-problem consensus), IBM's breach-cost data, and the harness-engineering framing — with the 90/10 heuristic and the excluded McKinsey claim flagged for honesty.
The weights were never the surface. Budget for the harness — the retrieval, the tools, the connectors — or ship the attack surface with the feature.