ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,101 words · 3 moves to watch
The Signal

Microsoft is swapping OpenAI and Anthropic out of Copilot and GitHub for in-house models

DPIAs, subprocessor lists, and identity threat models written before this quarter are stale. Google opens a free agent-building course to 1.5M developers on June 2. We flagged persistent-grant agents as the next pivot two weeks ago. They are now shipping from two vendors at once.

In Play

  1. Microsoft Copilot: Silent Model Swap + Autonomous Agents in 60 Days

    Microsoft is replacing OpenAI/Anthropic inference with homegrown models for Copilot and GitHub, while shipping autonomous 24/7 agents and a unified Copilot app. This changes subprocessor chain, identity threat model, and blast radius within 30-60 days — no customer action required for the swap to take effect.

    Ask Clarity

  2. RL Post-Training as Unaudited Supply-Chain Attack Surface

    Every frontier LLM (ChatGPT via RLHF, Claude via Constitutional AI, DeepSeek-R1 via GRPO) now has an RL post-training layer that accepts untrusted input at scale. This layer — reward models, preference data, alignment fine-tunes — is poisonable and sits outside standard TPRM questionnaires. Microsoft's model swap compounds the problem: the model behind your vendor API is now changeable without notice.

    Ask Clarity

  3. Agent Proliferation: Two Giants Accelerating Simultaneously

    Microsoft ships autonomous Copilot agents into M365 tenants while Google trains 1.5M+ developers to build tool-calling agents starting June 2. The convergence means agent-specific threats (confused deputy, memory poisoning, prompt injection via shared content) move from research to production within 90 days. Most SOCs have zero agent-aware telemetry.

    Ask Clarity

  4. Developer Shadow AI Reaches Critical Mass

    GitHub's COO admits Cursor, Claude Code, and ChatGPT are pulling developers away — Microsoft considers it a threat to GitHub's core business. Google's vibe-coding curriculum at 1.5M-learner scale will flood repos with LLM-generated code. Corporate devs pasting internal code into Kaggle notebooks adds a data-handling concentration risk.

    Ask Clarity

Deep Dives

Microsoft's 60-Day Copilot Overhaul: Three Changes That Break Your Security Model Simultaneously

What Changed

Microsoft Build 2026 confirms three changes shipping to M365 tenants inside 30-60 days. None require customer action. None guarantee admin notification before the swap.

  1. Model swap: OpenAI and Anthropic models replaced by Microsoft homegrown models for "simpler tasks" — transcription, image generation, basic reasoning, code completion
  2. Autonomous agents: Copilot agents operating 24/7, around the clock, without interactive sessions
  3. Unified app: A single Copilot surface spanning Office and coding. One token compromise, broader blast radius

Microsoft retains free use of OpenAI IP through 2032. The branding stays. The inference path does not. The label on the box and the contents of the box are no longer the same thing.

Compliance Impact

The consequences are mechanical:

  • DPIAs written against "Azure OpenAI" or "Anthropic via Azure" no longer describe the actual data flow
  • SOC 2 subprocessor lists referencing those third-party models require revision
  • DPA/BAA scope may not cover a Microsoft-proprietary model with different training data, different retention, and potentially different geographic processing
The risk is not that the models stop working. The risk is that a single-vendor assumption was carrying weight it was never designed to carry.

Identity Threat Model Expansion

Agents run on persistent OAuth grants, not interactive sessions. The attack surface is the one Microsoft and Mandiant have been tracking since 2024: token theft, illicit consent grants, and lateral movement via the Graph API. Default Entra ID still permits user-level consent to Mail.ReadWrite, Files.ReadWrite.All, and Sites.FullControl.All.

Indirect prompt injection becomes the primary vector. Payloads in shared documents, calendar invites, Teams messages. The agent reads shared content autonomously and acts on it. Most tenants have not tuned Defender for Cloud Apps or Purview to flag instruction patterns in inbound shared content.

The Microsoft-OpenAI Restructuring Context

Both sources confirm the structural relationship has changed. Microsoft and OpenAI now have explicit room to compete. Vendor diagrams treating them as a single dependency are out of date. For TPRM purposes these are two risk entities with separate model provenance, even where the invoice still looks like one.

What to do

  1. Open vendor change review on Microsoft Copilot/Azure OpenAI service to identify which models handle which workloads post-Build 2026 and whether DPA/BAA still covers the new inference path

  2. Restrict Entra ID app-consent to admin-only for Graph scopes including Mail.ReadWrite, Files.ReadWrite.All, Sites.FullControl.All, and any new 'Agent' scopes Microsoft introduces

  3. Deploy prompt-injection detection rules in Defender for Cloud Apps / Purview to flag instruction-like patterns in shared M365 content (documents, calendar invites, Teams messages)

  4. Request updated subprocessor disclosures from Microsoft for M365 Copilot and Azure AI Foundry, with explicit model-level attribution per workload

The Invisible Supply Chain: RL Post-Training Poisoning Meets Silent Model Swaps

Two Problems Converging Into One

Two facts on the table. Microsoft has demonstrated that the model behind a vendor API can be swapped without customer notification. Every frontier LLM now ships with a reinforcement learning post-training layer that ingests untrusted input at scale and sits outside standard vendor questionnaires. The practical consequence: the model in production today is not necessarily the model in production yesterday, and no version was audited for supply-chain integrity at the training layer.

The RL Attack Surface

The post-training pipeline — reward models, preference data, RLHF loops, RLAIF variants, tool-use traces — has the standard properties of an attack surface worth attention:

  • It accepts untrusted input (preference data from contractors, open-source reward models)
  • It runs at scale on shared GPU clusters with credentials predating current IAM posture
  • Its build artifact is weights that don't appear on EDR dashboards

The attacks are not exotic. Data poisoning of preference sets to install latent triggers. Reward hacking that surfaces as policy drift. Supply-chain compromise of open-source RL libraries imported six months ago and never pinned. None require a nation-state. Several have been demonstrated publicly.

The people who understand RL post-training and the people who run the SOC are, with rare exceptions, not the same people and do not attend the same meetings. Until they do, the threat model will keep being written after the incident rather than before it.

The Vendor Opacity Problem

Standard vendor risk questionnaires do not ask about RLHF data provenance, reward-model training datasets, or alignment fine-tune methodology. When Microsoft can swap the underlying model without notification, and every model provider runs an opaque RL layer between pretraining and production, the vendor trust assumptions fail at two levels at once.

The gap between organizations that have training-pipeline controls — signed datasets, reproducible runs, provenance on every reward signal, red-team evaluations as gating tests — and those that don't will be the story for the next twelve months.

Practical Mapping

VendorRL MethodAudit VisibilitySwap Risk
OpenAI (ChatGPT)RLHFNone publiclyMedium (API versioned)
Anthropic (Claude)Constitutional AI / RLAIFPublished methodology, no dataset auditLow (model cards exist)
Microsoft (Copilot)Undisclosed homegrownNoneHigh (swap confirmed, silent)
DeepSeek (R1)GRPOPaper published, no independent auditMedium (open-weight)

What to do

  1. Extend TPRM questionnaire for all frontier LLM vendors to cover RLHF/preference-data provenance, reward-hacking red-team coverage, model-swap notification commitments, and alignment-bypass disclosure SLAs

  2. Request written confirmation from Microsoft on model-swap notification cadence for M365 Copilot and Azure AI Foundry workloads

  3. Brief the ML/AI engineering team and SOC jointly on RL post-training threat models using MITRE ATLAS as framework, with shared ownership documented

  4. Add model-provenance verification to CI/CD for any application consuming frontier LLM APIs — log model version headers, hash responses for drift detection

Agent Proliferation Forecast: Microsoft + Google Create a 90-Day Detection Gap

Two Accelerants, One Timeline

Microsoft and Google are both scaling agent deployment in the same 60-90 day window, through different vectors:

  • Microsoft: Shipping autonomous Copilot agents directly into M365 tenants — no developer action required, agents operate on persistent OAuth grants with 24/7 access to tenant data
  • Google: Training 1.5M+ developers through a free 5-day course (starting June 2) whose capstone is deploying autonomous, tool-calling agents to production

The convergence creates a detection gap. SOCs instrumented for endpoints, identity, network, and cloud control plane have zero telemetry for agent-specific behaviors: tool-call chains, memory-store poisoning, cross-agent communication, and autonomous API invocations under service identities.

Google Course as Threat Forecast

The Google curriculum maps directly to threat categories your detection stack needs to cover:

Course ModuleThreat ClassDetection Requirement
Day 2: Tool integrationConfused deputy, SSRFTool-call allowlists, egress filtering
Day 3: Persistent memoryMemory poisoning, cross-tenant bleedMemory-store ACLs, write anomaly detection
Day 5: Production deployShadow agents, unmanaged service identitiesService principal inventory, consent monitoring

Every capability in that curriculum will appear in your environment within 90 days. The question is whether security review exists before the agents do.

The Shadow-Agent Risk

Google running this course on Kaggle creates a secondary exposure: corporate developers will paste internal code, prompts, and API specifications into Kaggle notebooks owned by Google. This is code egress through a training platform, not a sanctioned development tool. Most DLP stacks are not configured to detect it.

Combined with the developer defection from GitHub Copilot to Cursor, Claude Code, and ChatGPT (acknowledged by GitHub's COO as a core business threat), the control surface for where code and credentials flow is expanding faster than policy.

Google is about to teach a million developers to ship tool-using agents in five days. The security review needs to be ready before the agents are.

What to do

  1. Issue pre-enrollment guidance to engineering by May 31 covering acceptable data in Kaggle notebooks, prohibiting proprietary code/API specs, and requiring security review before any course-built agent touches production credentials

  2. Stand up an LLM/agent threat model and security review checklist aligned to OWASP LLM Top 10 + MITRE ATLAS, covering prompt injection, tool-call authorization, memory-store ACLs, egress filtering, and full audit logging

  3. Deploy agent-aware detection rules: tool-call telemetry, anomalous egress from agent service accounts, prompt-injection signatures in tool outputs, memory-write anomalies — pilot against internal sandbox agent

  4. Issue interim shadow-AI policy for coding assistants (Cursor, Claude Code, ChatGPT desktop) with egress detection for source-code exfil to non-sanctioned AI endpoints

The bottom line

Microsoft is silently swapping the AI models behind Copilot and shipping autonomous 24/7 agents into your M365 tenant within 60 days — while Google simultaneously trains 1.5 million developers to build tool-calling agents starting June 2. Your compliance documentation, identity threat model, and vendor risk questionnaires were written for a world that ends this month. The 30-day window before these changes land is the last clean opportunity to update DPIAs, lock down Entra ID consent, and build agent-aware detection before you're running incident response instead of architecture review.