An agent working with applications, professional documents, and recruitment records needs clear limits on what it can access and change. As we expand Vision’s capabilities, those limits remain part of how work is executed across the platform.

Recent security research shows why this matters. Instructions hidden inside ordinary documents or retrieved content can attempt to redirect an agent. Connected tools can then turn a misleading instruction into an unauthorized operation. Securing the complete workflow is therefore essential.

An expanding attack surface

Prompt injection exploits the way language models process instructions alongside external information. A page, document, or message can contain text intended to override the user’s request. An agent may encounter that text while performing a legitimate task.

NIST’s research on agent hijacking explains this risk and the need for adaptive evaluations. Testing only a fixed collection of known attacks can miss new strategies and weaknesses that emerge across longer tasks.

In 2025, the EchoLeak case study examined a vulnerability in Microsoft 365 Copilot where a crafted email could lead to data exfiltration without the user clicking a malicious link. In May 2026, Microsoft disclosed patched vulnerabilities in Semantic Kernel that could turn model-controlled tool input into code execution in affected configurations. These cases illustrate different ways that untrusted content can cross into privileged operations.

Permissions enforced during execution

In Employza, access follows the authenticated account, its role, the relevant records, and current capabilities. Vision works within that scope when it retrieves information or requests an operation.

Authorization remains a platform responsibility. A statement in a conversation, uploaded file, or saved memory cannot grant access to another account or establish permission to change a record.

That distinction matters when a request spans several operations. Each supported action must remain valid in the current account context, even if an earlier step succeeded.

Keeping delegated actions within scope

OWASP identifies excessive agency as a combination of unnecessary functionality, overly broad permissions, and too much autonomy. The possible impact depends on the operations an agent can reach.

We distinguish access to information, preparation of work, and execution of changes. Vision can prepare a supported action while preserving the confirmation required to commit it. Approval applies to the proposed action and its scope.

Realtime Voice follows the same action boundaries. Speaking to the agent changes how the user directs the work; the account’s permissions and confirmation requirements continue to govern execution.

Protecting context and personal information

Documents and retrieved information can help answer a question, but their contents remain separate from account authority. Our approach combines that boundary with data minimization: assistance should use information relevant to the work being performed.

Personal Memory follows the same principle. It is optional, is off by default, and retains selected context after activation. Users can review saved memories, pause the feature, and delete individual items or all saved information. A saved preference can inform assistance without becoming permission to act.

These controls address different parts of the problem. Limiting context reduces unnecessary exposure, while authorization constrains what an operation can affect. Neither should be treated as a complete solution to prompt injection on its own.

Clear results for everyday work

Security also depends on accurately representing what happened. Employza uses the result of the platform operation to establish whether work completed, remains in progress, failed, or was blocked. A generated response alone does not establish completion.

For candidates, that distinction matters when managing applications or changes to professional information. For employers, it matters when working with recruitment records and organizational tasks. Users need to know which actions occurred before deciding what to do next.

Combining scoped access, meaningful confirmation, and accurate outcomes makes delegation easier to review. The user can understand both the intended action and its actual effect.

Continuing the work

Agent security evolves as capabilities and attack techniques change. Public research increasingly examines complete action sequences, adaptive attacks, and the interaction between models and surrounding software. We treat these findings as an important part of the engineering context for expanding Vision.

Our focus is to make increasingly useful capabilities operate within clear boundaries for users and organizations. The AI Transparency Notice explains the public principles for Vision actions, personal information, Memory, and human oversight.