Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

AI in the Middle: using Grok and Microsoft Copilot web-fetch features as covert C2 proxies

AIR-2026-0044 AIR record · 2026-02-checkpoint-ai-in-the-middle-c2
Open in dashboard About
From the supporting source
This technique was demonstrated against platforms such as Grok and Microsoft Copilot, leveraging anonymous web access combined with browsing and summarization promptsresearch.checkpoint.com
The record
Disclosed
2026-02-17
Vendor
xAI, Microsoft
Product
Grok and Microsoft Copilot web interfaces (abused)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Policy drift
System type
Generative model
Who acted
Agent acted — Grok and Copilot fetched the attacker's URLs, acting as the C2 relay
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Abuse of unauthenticated web fetch
Impact type
Covert c2, Data exfiltration, Detection evasion
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
enterprises that allow AI service domains as trusted egress
Capability abused
url_fetchbrowsingsummarisation
Defense & remediation
Recorded defense
egress filtering on suspicious infrastructure
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Taxonomy & references
OWASP ASI03 Identity and Privilege AbuseATLAS AML.CS0061ai_service_as_c2trusted_domain_egressno_credential_to_revoke
Curator notes
Check Point Research. Because the abused web-fetch flows need no authentication, defenders cannot kill the channel by rotating keys or suspending accounts.
Supporting sources
Cite as
Enkrypt AI. "AI in the Middle: using Grok and Microsoft Copilot web-fetch features as covert C2 proxies". AIR, AIR-2026-0044. https://agentincident.vercel.app/i/AIR-2026-0044/ (accessed 2026-10-19).