Microsoft Wrote the Shared Responsibility Model. It Has No Word for an Assistant That Reads Untrusted Documents on Your Behalf — So We Built the Customer-Side Tooling and Gave It Away.

Patrick Duggan
4 hours ago
8 min read

Every enterprise cloud contract signed in the last fifteen years rests on one diagram, and Microsoft did more than anyone to put it there. There is a line. Below it is the provider's problem — power, cooling, hardware, hypervisor. Above it is yours — operating system, patches, application, data, identity. Microsoft publishes it, ships it in Azure documentation, teaches it in certification tracks, and defends it in contract negotiations. So does everyone else, because Microsoft made it the industry's shared vocabulary.

The line is not a security control. It never was. It is an answer to one question: which of the two organisations gets fired. That is why it is sellable, and that is genuinely useful — an unowned responsibility is the most expensive kind.

On July 28 we published an argument that the model has no word for the baseboard management controller: a component that sits below the line, is operated by the provider, and holds total authority over everything above it. Our conclusion then was that this is not a gap in the model to be patched with a new row in the table. It is evidence that the boundary was always a commercial artifact rather than a technical one.

Four weeks later the same shape arrived from the opposite direction, and this time it is not a management chip in a rack somewhere. It is the assistant in your word processor.

Where the assistant actually sits

Run the AI assistant through the diagram honestly and it does not fit anywhere.

It is operated by the provider — Microsoft runs the service, owns the model, ships the classifiers, and controls what versions you get. That is below the line.

It acts inside the customer's half — on your documents, with your employee's privileges, against your data, producing artifacts your business relies on. That is above the line.

And it does the thing that breaks the diagram entirely: it reads untrusted content and treats what it reads as direction. No component in the original model does that. A hypervisor does not take instruction from a guest's file contents. A storage service does not act on what is inside the object. The assistant's whole purpose is to read your material and act on it, which means the trust boundary runs through the middle of a single component that neither party fully owns.

Microsoft did the hard things and it did not hold — and that is the point

This is where a post like this usually turns into a dunk, and it should not, because the facts do not support one.

Norwegian data scientist Håkon Måløy reported a Copilot for Word prompt-injection worm to the Microsoft Security Response Centre on March 6. Hidden white-on-white instructions in a source document are read by Copilot as operator instruction; it tampers with the output — his demonstration silently halves financial figures, which survives review in a way that deleting them would not — and re-embeds the payload into the generated document, arming the next one.

Microsoft shipped a patched "Edit with Copilot" experience in early April. Måløy reworded the injection; it worked again. MSRC opened further cases. On July 14 Microsoft upgraded the underlying model to GPT-5.5 — a full model swap, the largest available intervention. On July 15, one day later, Måløy demonstrated it against the new model.

144 days, at least two fixes, and a model upgrade. Nobody was asleep. Microsoft applied the biggest hammer in the building and the nail did not move. Måløy's own explanation is the sentence that matters most in this whole story: a model has to read untrusted content in order to judge whether that content is safe. The classifier is a model. It ingests the hostile text to rule on it. The defence and the attack surface are the same component — so every fix that teaches the model to recognise a bad prompt is a fix that loses to a rewording.

That is not a Microsoft failure of effort or competence. It is a property of the architecture the entire industry adopted at once, and OpenAI's models sit underneath Copilot precisely because they are the best available — the model upgrade was the right call and it still did not work. Anyone who tells you their assistant is immune has not been pointed at yet. Måløy's related Outlook finding got an identifier, [CVE-2026-55145](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-55145); the Word worm did not, which is its own shared-responsibility problem, because a defect with no identifier never enters your ticketing system.

The half nobody owns

Here is where the model does real damage, and it is worth stating precisely.

Microsoft's half is genuinely bounded, and Microsoft is doing it. Secure the service, patch the pipeline, run the classifiers, upgrade the model, publish the advisory. All of that is happening.

The customer's half is where this attack actually lives — and it is a half most organisations do not know they hold. Which documents entered your tenant from outside? Which of those were used as source material for a Copilot-assisted draft? Which generated documents inherited hidden content from their sources? Blast radius here follows document lineage, not network topology, and almost no organisation on earth can currently answer any of those questions.

Microsoft cannot answer them for you. Not because Microsoft is unwilling — because the provider genuinely cannot see which of your documents you consider trustworthy or where they came from. That judgment is irreducibly yours. It is correctly above the line.

But there was no tooling for it, and no product to buy. A responsibility that is correctly assigned and has no instrument attached is functionally unassigned. That is the failure mode, and it is the same one the BMC post described from below: the model tells you whose problem it is and stops there.

So we built the customer-side instrument and gave it away

We are a two-person company in Minnetrista, Minnesota. We are not going to fix prompt injection, and this post does not claim to. What we can do is make the invisible layer visible on the customer's side of the line, ship it free, and keep it small enough that you can read it before you run it.

[agent-guard](https://github.com/pduggusa/dugganusa-agent-guard) — MIT, zero dependencies, one file, about a hundred lines, runs entirely locally so nothing leaves your machine. It finds invisible Unicode hidden in the instruction files your AI agent reads before it does anything else: CLAUDE.md, .cursorrules, and — the Microsoft-ecosystem one — `copilot-instructions.md`. Including the Unicode tag block, which carries a full readable ASCII payload and renders as absolutely nothing in an editor, in a diff, or in a pull-request review.

This is not hypothetical. The TrapDoor supply-chain campaign, discovered and documented by [Socket](https://socket.dev), submitted pull requests to prominent open-source AI projects carrying modified .cursorrules and CLAUDE.md files written in zero-width Unicode. What the reviewer sees is a tidy list of project guidelines. What the model receives is something else entirely. Credit for that discovery is Socket's, not ours; we built the free detector for the rest of us.

And the rest of the Microsoft-ecosystem work, all public, all MIT:

[dugganusa-sentinel](https://github.com/pduggusa/dugganusa-sentinel) — Microsoft Sentinel data connector, ingests our STIX feed over TAXII 2.1. Over a million indicators, auto-enrichment, Content Hub ready.
[dugganusa-vscode](https://github.com/pduggusa/dugganusa-vscode) — VS Code extension that checks IPs, domains, hashes and CVEs in your code against the feed, without leaving the editor.
[dugganusa-action](https://github.com/pduggusa/dugganusa-action) — GitHub Action that scans pull requests for threat indicators, so the check runs where the review already happens.
[dredd-mcp](https://github.com/pduggusa/dredd-mcp) and [dredd-mcp-scanner](https://github.com/pduggusa/dredd-mcp-scanner) — pre-flight vetting for MCP servers before you install one, because "an agent installed a thing" is the newest version of this same unowned half.

What agent-guard does not do, said plainly

It covers the repository container — instruction files, invisible Unicode. It does not detect the Copilot for Word worm, because that payload is white-on-white formatting inside a .docx, which is a different container and a different concealment mechanism. Same class of attack, same side of the line, different file.

We are saying that out loud because the alternative is letting a reader assume they are covered when they are not, and an overclaimed detection is worse than no detection. That gap — hidden content in inbound Office documents, scanned before they reach a Copilot-enabled tenant — is the next thing on our bench, and if somebody beats us to it and open-sources it first, good. The point is that the customer's half gets an instrument, not that we are the ones holding it.

Capped where we always cap it at 95 percent: agent-guard is new, it has essentially no adoption yet, and we are not going to dress up a repository with no stars as an industry standard. It is a hundred lines that work, given away, aimed at a real hole.

The ask, stated openly rather than hinted at

If you are a Microsoft MVP or you work at Microsoft and any of the above is useful to you or your customers, we would welcome an MVP nomination — for the open-source security work: the Sentinel connector, the VS Code extension, the GitHub Action, agent-guard, and the MCP pre-flight tooling. All MIT, all free, all pointed at the customer's half of a line Microsoft drew and that the AI era has genuinely outgrown.

I will be honest about the motivation, because pretending otherwise would be silly in a post whose entire argument is that honesty about your own position is the product. I do not go to Ignite. I have, however, walked past the MVP lounge, and I have seen the free cookies and the notably comfortable seating. I am also a man who loves a little plastic thing for the shelf. Those are real reasons. They are not the main reason, but I am not going to stand here and claim they carry no weight.

The main reason is duller and more useful: an MVP badge is a distribution channel for tooling that is currently free, small, and almost entirely undiscovered. Nought stars on agent-guard is not a humblebrag, it is a number. The work does more good in more hands, and the badge is one of the few honest mechanisms for putting it there.

We would rather ask directly than build a post engineered to be discovered by the right person. That felt like the more honest version — and if the answer is no, the tools stay free and the argument stands on its own.

If you are not in a position to nominate anyone, the more useful thing is smaller: run agent-guard against one repository this week and tell us what came back — including, and especially, if the answer was nothing. Clean results almost never get published and they are half the data anyone needs to know whether a detector is worth running.

The through-line

The shared responsibility model had no word for the BMC, and it has no word for the assistant. Both times, the answer is the same: the line was never a security boundary — it was an accountability boundary, and accountability boundaries fail silently in exactly one place, the seam where each side reasonably believes the other has it.

That is why every finding worth publishing this month lived at an edge rather than in a control. The controls are mostly fine. The handoffs are where nobody is standing.

Sources

Håkon Måløy's Copilot for Word disclosure and the MSRC timeline, as reported by iTnews, The Register, CSO Online, Malwarebytes and Cybernews, July–August 2026; CVE-2026-55145 is his related Outlook Copilot finding. The TrapDoor .cursorrules/CLAUDE.md zero-width Unicode campaign was discovered and documented by Socket.

Our own prior coverage: "The Shared Responsibility Model Has No Word for the BMC" (28 July 2026), the three-coding-agent injection study (2 August 2026), and today's Copilot for Word write-up.

If your organisation has ever tried to answer "which documents were used as source material for which other documents," I would like to hear how far you got. My guess is not far, and I would like to be wrong about that. Rate this post below.

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=microsoft-wrote-the-shared-responsibility-model-it-has-no-word-for-an-assistant-that-reads-untruste