| Attack / Incident | M1 Input filter |
M2 Lock goal |
M3 Least priv. |
M4 Monitor |
M5 Human loop |
M6 Auth agents |
M7 Circuit brk. |
|---|---|---|---|---|---|---|---|
| EchoLeak CVE-2025-32711Email → Copilot → mailbox exfil | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| PerplexedBrowser — file exfilCalendar invite → local file theft | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| PerplexedBrowser — credential theftCalendar invite → 1Password exfil | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| McKinsey Lilli red teamDirect manipulation → platform compromise | ✓ | ✓ | ✓ | ✓ | ✓ | ||
| Multi-agent cascade (S06)Poisoned sub-agent output → orchestrator hijack | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Invoice payment redirect (S07)PDF metadata → payment routing change | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Gradual goal drift (S09)Slow behavioral shift across many sessions | ✓ | ✓ | ~ |
✓ = this mitigation directly addresses the attack vector or limits its impact. ~ = partial coverage — reduces probability but was bypassed in the documented incident (EchoLeak defeated M1; PerplexedBrowser used language obfuscation to partially evade M1). Empty = this mitigation does not address this attack path.
No single column covers every row. MIT 02 (lock goal) and MIT 03 (least privilege) are the highest-coverage controls — they appear in every documented real incident. If you can only implement two mitigations today, start there.