All signs point to your AI assistant working exactly as it should. It’s answering chat inquiries, locating files, and replying to the countless everyday inquiries that might otherwise disrupt your daily workflows. But what if someone were looking over its “shoulder,” feeding it prompts of their own, reading what it reads, and even leveraging legitimate permissions for expanded access? How would you ever know?

Security researchers at Rubrik Zero Labs recently demonstrated this capability using a mainstream enterprise AI assistant. They created a working exploit chain, dubbed “ChatMate,” to turn a single malicious document into an attack that would be nearly impossible to detect and relatively easy to do. No malware alerts or obvious evidence of wrongdoing; just an AI assistant that happens to be assisting someone else. They will present the research for the first time at Black Hat USA 2026, and demonstrate how attackers could leverage this two-way “prompt shell” in real time using an emerging attack class known as Remote Prompt Execution (RPE) that’s worthy of a place on every cyber leader’s radar.

How RPE works

Modern AI assistants don't just respond to prompts. They are built to run on code interpreters that allow them to build spreadsheets, parse documents, and perform computations. Rubrik Zero Labs research demonstrated that a booby-trapped Word document containing invisible instructions hidden behind white-on-white text could convince a popular AI assistant to run attacker-supplied code the moment an employee uploaded it for an ordinary task. 

Indirect prompt injection, as this type of attack is known, is well-documented within the security community. What makes ChatMate novel research is the way it links stepwise exploits together in a way that ultimately allows the attacker to escape the "sandbox" that typically serves to stop any one compromise from enabling a spillover into other systems. 

Once this was achieved in the case of ChatMate, the code talked its way past the assistant's safety checks, escalated privileges inside its sandbox, exploited an unrelated flaw in the surrounding cloud infrastructure, and used it to break out onto the underlying server, which unlike the sandbox, had internet access. That last step opened a bidirectional channel back to the attacker that allowed the threat actor to send prompts into the victim's live assistant session and read back the answers, using the victim's own credentials and data access the whole time.

In this case, the chain was reported responsibly and fixed prior to any public disclosure. But there’s simply no guarantee that the next case will also feature an ethical hacker behind the keyboard. 

ChatMate’s larger lessons

The impact of this exploit doesn’t lie with a specific bug. Bugs are patchable. What’s more important is the extent of the attack surface underneath it. AI assistants embedded in everyday productivity tools are now used by a majority of large enterprises across the Fortune 500, with hundreds of millions of people popping one open on a typical workday. Each of those sessions runs on shared cloud infrastructure with a code interpreter attached, and each can theoretically be reached by the same exploit chain, by weaponizing a document, email, or other shared file most employees wouldn’t think twice about opening.

Consider a related example. In July 2026, Hugging Face, one of the world’s largest publicly available repositories of AI models and datasets, confirmed that an autonomous AI agent had exploited two code-execution flaws in its data-processing pipeline, escalated to server-level access, and harvested internal credentials before being contained. The company, product, and attack path were all different. What remained the same was the targeting of the underlying code base powering our AI systems.

If these chains are systematically discovered and executed against live assistants with real access to corporate data, the exposure could potentially extend to whatever that assistant can otherwise reach, including email, files, calendars, chat history, and potentially protected intellectual property the model was trained on. On top of direct data exposure, businesses would face the ordinary costs of any serious intrusion spanning discovery, remediation, downtime, reputational harm, and potential compliance violations. IBM’s most recent study estimated these costs and others add up to an average of $4.44 million per breach. 

There is another, significant but more subtle cost. As corporations spend millions to incorporate AI assistants into their operations, a loss of trust in their ability to be secured could cost a business more in productivity losses than anything resembling the initial bill for recovery operations. 

So, has the time come to pull the plug on AI implementations? Certainly not. But the proof-of-concept discovered over the course of this research—code-executing assistants, sandbox escapes, shared cloud plumbing, and a tendency for implicit trust among users—makes RPE an emerging attack class worthy of monitoring by vendors and security professionals.

The stranger reading over your assistant's shoulder was identified and expelled this time. But would your organization notice if it were to happen again, somewhere else, tomorrow?