Remote Prompt Execution: When the Document Becomes the Shell

One document. Five stages. A shell that wears your face. At Black Hat USA 2026, security researchers Ori Lahav and Dan Avraham of Rubrik Zero Labs did not present another theoretical LLM jailbreak. They demonstrated a five-stage exploit chain that turns an ordinary prompt injection into a persistent, bidirectional interactive shell inside Microsoft 365 Copilot. The line between content and command — between text a user reads and code a machine executes — did not blur. It vanished. The flaw underneath the demo is CVE-2026-32193, a path traversal vulnerability in Microsoft Azure Kubernetes Service. Microsoft gave it a CVSS score of 8.8 and paid $48,000 through its bug bounty program before shipping a patch in the June 2026 security update. But the CVE is only a lockpick. The architecture is the open door. We have spent three years asking how to make large language models safer. That question was incomplete. The better question is how to make the systems around them less trusting. Remote Prompt Execution, Defined Rubrik’s technical blog, authored by Kyle Fiehler and published on July 30, 2026, calls the vulnerability class Remote Prompt Execution, or RPE. The name is precise: prompt injection is no longer the final payload. It is the opening move of a chain that ends in code execution outside the model’s sandbox. In the Copilot demonstration, the chain begins when an attacker uploads a Word document containing hidden white-on-white text. The model reads the document, processes the hidden text, and the injection bypasses the safety classification guardrails. That gives the attacker privilege escalation inside the Copilot sandbox. From there, the exploit targets the ACA-Session-Interpreter, the dynamic session component of Azure Container Apps, using a path traversal flaw in the underlying Azure Kubernetes Service. The final stage is an LD_PRELOAD injection that escapes the sandbox and reaches the host. None of these steps is remarkable on its own. Prompt injection is common. Sandbox escapes have existed for decades. Path traversal is a well-known vulnerability class. What makes RPE significant is the combination. The chain is the threat. And the chain is made more severe by an architectural decision that most product teams have already made without noticing: the AI assistant inherits the user’s identity. Once the attacker escapes the sandbox, they establish a bidirectional channel. They can inject prompts into the user’s live Copilot session. They can read the responses. The session inherits the user’s identity, permissions, and access to enterprise data sources like Microsoft 365 and Azure. The attacker acts as the user. Data exfiltration and persistent access become possible. All of it is triggered by a single document upload — no phishing link, no credential theft, no malicious macro. Just a document. The Chain Is the Threat Every stage of this attack has a defense that fails in isolation. A content filter can catch some injections, but not one that hides in white-on-white text. A sandbox can constrain the model, but not a container that was never given a separate permission identity. A Kubernetes patch can close one path traversal, but the same pattern will appear in the next orchestration layer. A security team can monitor for long-running shells, but the attacker does not need a long-running shell if they can reuse the user’s existing session. This is why RPE should be read as a systems design problem, not a security bug report. The chain is not five unrelated defects. It is one coherent path from untrusted content to trusted execution. In any healthy system, the path would not exist. The document would be data. The model would be an inference engine. The execution environment would be a separate, distrustful component. Instead, a single product collapses all three into one surface, and the surface is exposed to every user who opens a file. ACA-Session-Interpreter deserves special attention. Dynamic sessions in Azure Container Apps are designed to give each user an isolated Python interpreter and workspace. Isolation is the product’s core promise. The path traversal vulnerability breaks that promise at the orchestration layer. LD_PRELOAD then turns a broken permission boundary into a code execution primitive. The lesson is simple: an interpreter sandbox is only as strong as the orchestrator below it. I have spent most of my professional life thinking about boundaries. In 2017, at the peak of the ICO mania, I chose to audit the relayer architecture of 0x instead of chasing a token sale. The word that kept me awake was permissionless. A relayer can be regulated; a protocol cannot. But permissionlessness is not the same as identitylessness. The 0x design carefully separated the layer that routes orders from the layer that settles them. One could be front-run; the other had to be final. That separation is exactly what is missing in modern AI infrastructure. Copilot is designed as a single surface: it reads your document, reasons about your data, and then executes operations on your behalf. The ability to do all three is convenient. It is also the vulnerability. Stillness reveals the signal beneath the noise. The signal here is not the LD_PRELOAD trick or the missing permission check. It is the assumption that a model can be trusted to decide, in the moment, how much of the user’s digital life to touch. What Makes RPE a Class To understand why RPE matters more than the CVE, consider its shape. RPE is to prompt injection what remote code execution is to input validation. It is not a single exploit; it is a category of attack that shares a structure. That structure has three necessary components: untrusted content processed by an LLM, an execution environment that interprets model outputs as commands, and an identity relationship that grants those commands access to user data. Remove any single component and the exploit chain collapses. Keep all three and the specific CVE does not matter. The next vulnerability might be in a different cloud service, a different container runtime, or a different model provider. The shape will remain. The architecture that RPE targets is now the default for AI products. Many of them have code interpreters. Some have tool-calling workflows. Each one is a sandboxed execution environment with access to the user’s context. The names of the products change, but the permission graph is the same. RPE is a class, not a vendor’s product defect. Treating it as anything else will produce a series of patches that protect last year’s attack while the next chain is already being assembled. Identity Is the Payload Most commentary on prompt injection focuses on jailbreaks: getting a model to say something it should not say. RPE is not about speech. It is about action. The payload is the user’s identity. When a user opens a Word document, Copilot inherits the user’s context. That inheritance is the product. It is also the attack. Once the bidirectional channel is established, the attacker does not need to steal credentials. They are operating inside a session that already has them. They can read the user’s email, access documents, interact with Azure resources, and send messages with the user’s name attached. This is ambient authority: the agent has more power than the user intended to grant in a single action. The document was supposed to be a document. It became a proxy for the user. I saw the same pattern in DeFi in 2020, when I spent two hundred hours modeling undercollateralized lending on Aave and Compound. The promise of DeFi was financial inclusion. The mechanics told a different story: the protocols required over-collateralization to protect the lender, which excluded the people they claimed to help. The system’s safety came from making the borrower carry all the risk. LLM safety classifiers are the same. They are over-collateralization for an execution environment that never should have been exposed in the first place. We place impossible demands on a text classifier to block harmful instructions, while the surrounding system silently grants the session administrative privileges. The model is asked to be the boundary, and the boundary was never a model problem. This insight has direct consequences for incident response. If a security team investigates an RPE event, the log stream will show a user opening a document and then, a moment later, the user performing a series of legitimate-looking actions. There will be no malicious payload in the traditional sense. The payload is the user’s own permission set. The audit trail will look exactly like a normal working day, because the attacker is wearing the user’s face. The only way to catch it is to separate the identity of the prompt from the identity of the user, and to record that separation in every transaction. A Pattern, Not a Patch RPE did not arrive in a vacuum. This summer has been a rolling demonstration that agent infrastructure is the new attack surface. In July, CVE-2026-9198 in IBM Langflow triggered an emergency deadline from CISA after unauthenticated remote code execution was found in the platform’s default configuration. That is not a subtle flaw. An unauthenticated attacker could reach the system in its vendor-default state and execute commands. A separate Langflow flaw, CVE-2026-33017, was exploited within twenty hours of disclosure — a reminder that once a vulnerability is public, the weaponization clock starts immediately. And CVE-2026-55255, an IDOR in the same platform, allowed attackers to harvest LLM provider keys and cloud credentials from other users’ sessions. Meanwhile, Unit 42 documented an autonomous attack campaign in which threat actors deliberately selected DeepSeek because its safety guardrails were weaker than the alternatives. The attackers were not exploiting a single bug. They were choosing the target with the weakest boundary. Seen together, these incidents form a pattern: agent infrastructure is attractive not because it has more vulnerabilities, but because it concentrates trust. An agent has the user’s credentials, the model’s reasoning, and the host’s execution power in one product. It is a single point of failure by design. The protocol community learned this lesson the hard way in 2022. The collapse of Terra taught us that a system which promises stability through algorithmic mechanisms rather than auditable reserves is not a stable system; it is a confidence scheme with a dashboard. The same logic applies here. A system that promises safety through prompt filters rather than verified execution boundaries is not a safe system. It is a trust scheme with a chat window. The protocol remembers what the market forgets. The market forgot that trust is not something you embed in a model; it is something you verify at a boundary. RPE is the bill coming due. Rubrik’s technical blog is careful to note that ChatMate is a proof of concept, not an active exploit in the wild. The underlying issue was reported to Microsoft and fixed before public disclosure. That is a credit to Microsoft’s bug bounty process. But the architecture remains, and the next path traversal is only a discovery away. The patch does not dissolve the class. The specific path traversal in Azure Kubernetes Service has been patched. The broader RPE class has not. That is the sentence that should guide every board-level discussion about AI adoption for the next eighteen months. What the Fix Actually Requires The temptation will be to treat RPE as a Microsoft problem. It is not. Any AI chat interface that relies on containerized execution environments to give the model tools — code interpreters, document analyzers, workflow automations — has the same silhouette. The names change: Azure Container Apps, Langflow, custom Kubernetes clusters. The pattern remains: an LLM with access to a shell, and a shell with access to the user’s identity. What would a different architecture look like? Execution boundaries need to be striped of ambient authority. The environment should not inherit the user’s access. It should receive a short-lived, scoped credential that is created for the specific task and revoked when the task completes. The model should be able to write a file, but not read the user’s inbox, unless the user explicitly grants that entitlement in that moment. Untrusted content and executable instructions need to be structurally separated. A document that enters the system as data should remain data. The format itself must prevent hidden text from becoming a privileged prompt. This is a schema constraint, not a classifier output. If the platform cannot distinguish between a user’s phrasing and an instruction embedded in a document, the platform has no business giving the model a shell. Every agent action needs to be attestable. Each action should carry a cryptographic signature binding it to a specific session, a specific permission grant, and a specific parent event. The audit log should be tamper-evident. In 2026, I led a cross-functional team at a London-based protocol building a provenance layer to verify human-created content. The lesson from that work is simple: verification is a property of a chain of custody. Truth is a property of a claim. The same distinction applies to agents. You can verify whether an instruction came from a document or from a user, but only if the architecture demands it. These moves are not exotic. They are standard practice in protocol design. The difficulty is not technical. It is commercial. A product that asks for permission is slower than a product that silently assumes it. But the speed premium is exactly what RPE charges as interest. The Contrarian View: The Open Door The uncomfortable conclusion is not that Copilot is broken. It is that we built agents the way empires are built: we gave them too much authority and called it productivity. The security industry will respond to RPE with a familiar liturgy — more red teams, sharper prompt filters, better endpoint detection. All of that is useful. None of it is sufficient. The real vulnerability is not a path traversal in a Kubernetes service. It is the architectural assumption that an AI assistant should have access to everything the user can see. I understand the product pressure because I have sat on the other side of the table. During my work consulting for a UK pension fund in 2024, I saw how quickly institutions fall in love with the promise of AI copilots. They want the agent to read the entire corpus, query every database, and respond with total fluency. The promise is beautiful. The result is an environment where a single prompt injection can become a shell with the user’s face. We keep trying to patch the model instead of changing the architecture. That is like adding more guards to a prison while leaving the cell doors open. The deeper irony is that the technologies we need already exist. Cryptographic signatures, granular permissions, revocable credentials, and transparent audit trails are not exotic in protocol design. They are table stakes. The path from trust me, I am the model to trust this verified attestation is not a research problem. It is a design decision. The reason it feels difficult is that it would force vendors to give up ambient authority. Ambient authority is precisely what makes these products feel magical. There is no way around the trade-off. Trust is not given; it is verified. In an era where a Word document can become a shell, verification must happen before execution, not after. RPE also exposes a blind spot in the enterprise response playbook. Most organizations still think of AI security as a data privacy question. They ask whether the model can see sensitive information. They rarely ask whether the model can act on it. The Black Hat demonstration answers that question in the most direct way possible: a document upload becomes an interactive shell, and the shell inherits everything the user can see. The boundary between data and action is the boundary that needs hardening. There is also a market failure here. Enterprises are being sold AI platforms on the strength of their model quality, not their authorization model. The vendor that ships a weaker model with a strong permission boundary will look slower and more annoying than the vendor that ships a stronger model with ambient authority. The incentives are misaligned. Until security failures carry a cost that is visible to procurement teams, the market will continue to reward the architecture that makes RPE possible. I do not want to oversell decentralization. A blockchain cannot patch a bad authorization model any more than a prompt filter can. But the first generation of decentralized protocols was forced to solve exactly the problem that RPE exposes: how do we let untrusted code act on behalf of users without giving it the user’s entire identity? The answer was capability-based permissions, auditable transactions, and transparent failure. Those are not slogans. They are practical controls. The centralized AI industry is now arriving at the same problem with a much larger blast radius. Takeaway: The Only Permission That Matters The next twelve months will separate the platforms that treat AI security as a compliance checklist from those that treat it as a structural question. The enterprises that survive the shift will be the ones that demand least privilege for their agents, verifiable provenance for their prompts, and an audit trail that no dashboard can fake. They will not trust the model to decide what it should touch. They will make it impossible for the model to touch anything it was not explicitly given. Code is the only permission we truly need. Until we build execution environments that honor that principle, every document is a potential shell. RPE is not a bug in Microsoft 365. It is a warning written into the architecture of every AI product that asks us to trust convenience more than proof. The question is not whether we can patch the path traversal. The question is whether we are willing to build a world where no model inherits our identity by default. Patience is the validator of true intent. The path forward is not to move faster. It is to verify more. Liberation is not a promise; it is a state. So is security.