On March 10, 2026, Microsoft patched CVE-2026-26144. It’s an XSS bug in Excel. CVSS 7.5. On paper, medium-severity, the kind of thing that used to mean a stolen session cookie and a compliance ticket.
This one doesn’t steal cookies. A malicious payload embedded in a spreadsheet fires when Excel renders it, hijacks Copilot Agent, and instructs the agent to read the workbook and POST the contents to an attacker-controlled endpoint. No click. No prompt. The AI does the exfiltration itself, using permissions it was already granted. ZDI’s Dustin Childs called it “fascinating.” That’s one word for it.
The problem isn’t the bug.
It’s what the bug now controls.
The technique isn’t what’s interesting. The technique is thirty years old. What’s interesting is that the blast radius of a medium-severity XSS is now “everything the agent can touch.”
Every old vulnerability, new again
Pick a vulnerability class from any 2005 OWASP slide deck. It’s back, and it’s worse, because there’s now an autonomous actor on the other end of the exploit with network access and data access and a compulsion to be helpful.
SQL injection. In August 2025, a researcher disclosed SQL injection in Anthropic’s reference Postgres MCP server. The read-only restriction could be bypassed, allowing arbitrary SQL. This is the #1 item on the OWASP Top 10 since there was an OWASP Top 10, now shipped in the reference implementation of the protocol Anthropic designed to let AI agents talk to databases.
SSRF. CVE-2023-46229 in LangChain, disclosed by Palo Alto’s Unit 42. A crafted sitemap fed to a document loader gave attackers server-side request forgery — classic pivot into internal networks, wrapped in a RAG pipeline.
Path traversal. CVE-2026-34070 in LangChain. Prompt-template loading accepted crafted paths and returned arbitrary file contents. Config files, credentials, whatever the process could read. CVSS 7.5.
Insecure deserialization. CVE-2025-68664, disclosed in December 2025 by Cyata and nicknamed LangGrinch. CVSS 9.3. LangChain Core’s serialization didn’t escape user-controlled dictionaries containing the reserved lc key. That sounds esoteric until you notice what it means: LLM output, flowing through additional_kwargs or metadata or response_metadata, got rehydrated into real LangChain objects on the next deserialization pass. Prompt-injected text becomes an executable object. Patched four days before Christmas.
Remote code execution via serialization. CVE-2024-36480, LangChain again. Same family of bugs.
XSS. Back to where we started. CVE-2026-26144.
Every one of these is a vulnerability class that predates the iPhone. The novelty isn’t the bug. The novelty is what happens after the bug fires.
The data-becomes-instruction problem
There’s a deeper issue here than “AI agents have too many permissions,” and it’s worth naming plainly.
LLMs do not distinguish between data and instruction. Everything that arrives in the context window is treated as input to reasoning. A spreadsheet cell, an email body, a PDF, a webpage scraped by a RAG loader, a row returned from a database query — all of it gets fed to the model and all of it can steer the model’s behavior.
This is why prompt injection isn’t a “bug” that can be patched out. It’s a property of how these systems work. And it’s why the old vulnerability classes come back sharper in AI systems than they ever were in web apps:
A SQL injection in an MCP server doesn’t just leak rows. It feeds attacker-controlled rows back into the agent, which then acts on them.
An SSRF in a document loader doesn’t just reach internal services. It returns attacker-controlled text that the model will read as instructions.
An XSS in Excel doesn’t just run JavaScript. It runs JavaScript that tells Copilot what to do next.
The exploit is the delivery vehicle.
The payload is a sentence.
EchoLeak, ShadowLeak, and the zero-click future
Two incidents from 2025 make the pattern concrete.
EchoLeak (CVE-2025-32711, CVSS 9.3) was disclosed by Aim Security in June 2025. An attacker sent a Microsoft 365 Copilot user a crafted email. The user didn’t have to open it, click it, or acknowledge it. The next time they asked Copilot a normal question — “summarize my week,” whatever — Copilot processed the email as context, followed the injected instructions, and exfiltrated tenant data. First documented zero-click vulnerability in a production LLM system. Microsoft patched it in May 2025, before public disclosure.
ShadowLeak, disclosed by Radware on September 18, 2025, was worse in one specific way: the leak was service-side. ChatGPT’s Deep Research agent, connected to Gmail, processed a malicious email during routine work and exfiltrated mailbox contents from OpenAI’s infrastructure. The user’s browser and endpoint never saw the exfiltration. Traditional DLP doesn’t catch that. Traditional network monitoring doesn’t catch that. The data left from a cloud provider’s cloud provider.
Johann Rehberger demonstrated the same class of attack against Outlook Copilot earlier in 2025 — hidden prompt in an email, Copilot summarizes it, Copilot auto-invokes graph-search, MFA codes get exfiltrated. Microsoft shipped defenses in July.
These are not exotic. They are the logical outcome of giving a suggestible assistant read access to your mailbox and network egress.
What CVSS is missing
The Dark Reading coverage made a point I want to reinforce with numbers. CVE-2026-26144 scored 7.5. CVE-2025-32711 scored 9.3. Both are, in a traditional sense, “information disclosure” bugs. One is rated medium-high, one is rated critical, and the operational difference between them is mostly which product shipped the fix faster.
CVSS was designed in 2005 and updated in 2019. It has no vector for “the vulnerability hands control of an autonomous agent to an attacker.” It has no way to express that the agent has access to the user’s entire mailbox, calendar, SharePoint, and OneDrive. A vulnerability that would be rated medium against a dumb application is critical against an AI-enabled one, and your ticketing system doesn’t know the difference unless a human overrides it.
Until the scoring catches up, security teams have to do the overriding themselves.
What to actually do
Patching CVE-2026-26144 closes one door. It does not change the architecture that made the door worth kicking in. A few things that do:
Treat AI subsystems as privileged processes. Any application with an embedded agent — Copilot, Gemini in Workspace, Einstein in Salesforce, Duo in GitLab — should be modeled as a service account with the union of every permission the host app holds. Then model the compromise accordingly.
Separate AI-initiated egress from user-initiated egress in your monitoring. Your DLP almost certainly does not. An Excel process making an HTTP POST to an unfamiliar domain is not the same event as a user uploading a file, and your alerting should reflect that. If you can’t tell the two apart at the network layer, that’s a gap.
Block outbound egress from AI-enabled applications by default. Most Copilot use cases do not require arbitrary HTTP. Allowlist the endpoints that do. This single control would have broken CVE-2026-26144’s exfiltration path entirely.
Re-score AI-adjacent vulnerabilities manually. If a vulnerability touches an application with an embedded agent, bump it. A CVSS-7.5 XSS in Excel is not a CVSS-7.5 bug anymore.
Audit your MCP servers and RAG pipelines like you’d audit a public-facing API. Because that’s what they are, to an attacker. The LangChain CVEs and the Anthropic Postgres MCP SQLi are not edge cases. They are the normal state of hastily-shipped agent infrastructure.
The Dark Reading piece called this privilege amplification. That’s accurate but understated. The vulnerability doesn’t just get amplified — it gets repurposed. An XSS becomes a data-exfiltration primitive. A SQLi becomes a prompt-injection vector. An SSRF becomes a way to feed the model attacker-controlled context. The old taxonomy still describes the entry point. It no longer describes the impact.
Thirty years of vulnerability classes, all of them newly load-bearing.