1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Copilot's default configuration sends sampled operator data to an external LLM without documented input filtering, while autonomous tool placement operates without per-action approval gates.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Alteryx Copilot scores low on the composite index, reflecting moderate capability constrained by limited blast radius and partial vendor platform defenses.
Alteryx Copilot lands in the Tight Operators quadrant with an Attack Surface of 4.80, Blast Radius of 3.75, and Defense Controls of 7.
The table below presents the three dimension scores and the composite metric, scaled to their respective denominators for cross-agent comparison.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 3.75 | Low composite reflects moderate workflow-generation capability constrained by limited blast radius and the implicit user-run gate before any data processing executes. |
| Blast Radius | 3.75 / 10 | Copilot does not execute code directly; blast is limited to tool configuration, credential passthrough via workflow connectors, and outbound LLM communication. |
| Attack Surface | 4.8 / 10 | Moderate base scores with no agent-specific evidence penalties, but the combination of untrusted input, sensitive data access, and external egress elevates the headline. |
| Defense Controls | 7 / 15 | Vendor documents ISO 27001 cloud isolation and SOC 2 monitoring at the platform level but publishes no Copilot-specific input or output filtering. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Copilot's reasoning loop ingests user prompts, workflow metadata, dataset schema, and real data samples from workflow tool anchors as first-class input on the default configuration.
Higher scores indicate broader exposure to adversary-controlled content reaching the reasoning loop; Copilot's surfaces peak at tool configuration and data-sampling boundaries where operator data meets the external LLM.
Each row maps a named surface to its assessed score and a per-surface comment describing the observable condition on the default configuration.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Chat prompts and workflow comments flow to Google Gemini alongside auto-attached workflow metadata and dataset schema without documented input validation [7]. |
| External Data | 2 / 4 | Data Awareness samples real data from user-configured workflow tool anchors via YXBE snapshots and sends it to the LLM without content scanning [8]. |
| Memory | 2 / 4 | Conversation history is retained up to two years in Designer and ninety days in cloud, with no automated learning loops or cross-session skill codification [10]. |
| Reasoning | 2 / 4 | Multi-step reasoning generates tool selection and configuration within the declared workflow scope, constrained to supported analytics tool categories with visible output on the canvas [7]. |
| Planning | 2 / 4 | Copilot decomposes natural-language prompts into multi-tool workflow plans visible on the canvas; the user must click Run before any configured data processing executes [7]. |
| Tool Execution | 2 / 4 | The agent places analytics tool nodes on the canvas from a fixed supported set that explicitly excludes Python, R, and Command tools; workflow execution remains user-initiated [7]. |
| Orchestration | 1 / 4 | Single-agent operation within Designer with multi-turn conversations per session; no background execution, subagent delegation, cron scheduling, or headless operation is available from the Copilot feature [11]. |
| Inter-Agent | 1 / 4 | No inter-agent communication on the default configuration; the MCP Server enabling external AI tool integration is announced in Preview and not generally available [12]. |
| Output Processing | 1 / 4 | Output is limited to chat replies and canvas-level tool configurations inside the Designer workspace, with no rich rendering, URL embedding, or external side channels [7]. |
| Configuration | 2 / 4 | Data Awareness is enabled by default and Copilot cannot be disabled without uninstalling the component; GenAI tool capabilities are togglable via custom roles [7]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Copilot's default configuration reads sampled operator data from workflow sources, processes it through an external LLM, and provides no documented filtering on either input or egress channels.
Alteryx Copilot exhibits all three of these conditions in its documented default configuration:
- Untrusted input — The default-on Data Awareness feature pulls live data samples from workflow anchors connected to external databases, files, and APIs that may carry adversary-controlled content [8].
- Sensitive data — With Data Awareness enabled, Copilot accesses sampled operator data including PII, financial records, and proprietary datasets from workflow connectors [10][14].
- External egress — All prompts, workflow metadata, and sampled data are sent to Google Gemini by default, outside the operator's trust boundary [9].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Copilot session could configure tools to redirect data flows through workflow connectors, but direct code execution, deployment, and scheduling remain outside the feature's capability.
Higher scores indicate greater reach from a compromised session; Copilot's blast ceiling is bounded by the absence of direct code execution and deployment access.
Each row ties a scored factor to the observable default capability that constrains or extends what a compromised Copilot session could reach.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 1 / 4 | The agent assembles data preparation tool configurations on the canvas but cannot run arbitrary code, shell commands, or scripts; Python, R, and Command tools are excluded [7]. |
| File system access | 2 / 4 | Configured workflow tools can read from and write to file paths in connector configurations when the user runs the workflow; the default scope is the operator's local file system and connected network shares [7]. |
| Network access | 2 / 4 | Prompts and data samples transmit to the Gemini endpoint by default; workflow connectors can reach databases and APIs, but no arbitrary outbound HTTP requests originate from Copilot [9]. |
| Credential access | 2 / 4 | The Data Connection Manager stores database credentials within workflow context; platform-level CVEs have demonstrated session token exposure, account takeover, and admin API key extraction on the hosting Server [1][2][3][5]. |
| Autonomous action | 1 / 4 | Tool placement on the canvas occurs without per-action approval, but workflow execution requires an explicit user action before any data processing or external communication begins [7]. |
| Deployment access | 1 / 4 | Copilot cannot publish, deploy, or schedule workflows; publishing to the server platform requires separate user-initiated governance and approval processes [12]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Alteryx publishes ISO 27001 certified isolation and SOC 2 Type II operations at the platform level, but no Copilot-specific input filtering or output redaction is documented on the default configuration.
Higher scores indicate stronger vendor-implemented safeguards; Copilot's controls concentrate at the platform isolation and monitoring layers with gaps at the input and output boundaries.
Each component is scored on its vendor-implemented default state, with the confidence flag reflecting the evidence tier available for verification.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | No Copilot-specific prompt injection detection or instruction hierarchy is documented; the underlying Gemini model provides generic content safety filtering, which does not address injection attacks [9]. |
| Execution Isolation | 2 / 3 | Alteryx One provides ISO 27001 certified cloud isolation with control plane and data plane separation and optional Private Data Handling for customer VPC deployment; independent testing has targeted the Server platform [4][6][13]. |
| Action Controls | 1 / 3 | Copilot places tools without per-action approval; the user must run the workflow to execute, functioning as an implicit gate, and GenAI capabilities are togglable via custom roles [7]. |
| Output Guardrails | 1 / 3 | No DLP, credential redaction, or exfiltration blocking is documented for Copilot output; the vendor states that privacy cannot be guaranteed for data processed through the LLM [9]. |
| Monitoring | 2 / 3 | SOC 2 Type II certified operations with structured logging, incident response capability, and message history retention as an audit trail; Copilot-specific per-prompt monitoring is not documented [6]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize disabling Data Awareness for sensitive workflows and deploying input filtering to break the combination of untrusted input and external LLM egress.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require security review of all shared workflows before importing them into Copilot-enabled environments — counters User Input exposure from unvalidated workflow metadata and comments reaching the LLM.
- Configuration Disable Data Awareness in Copilot settings for workflows processing sensitive or regulated data to prevent real data samples from reaching the external LLM.
- Engineering Deploy a proxy-layer prompt injection classifier between the Copilot client and the LLM endpoint to filter adversarial content before it reaches the model.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Establish a policy requiring all Copilot-enabled workflows to run in isolated non-production environments before promotion to production data sources.
- Configuration Enable Private Data Handling to keep the data plane within the operator's VPC, preventing sampled workflow data from traversing shared cloud infrastructure.
- Engineering Instrument network-level egress controls to restrict Copilot LLM traffic to approved model endpoints and block unexpected outbound connections from the workflow environment.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Define a governance policy requiring operator review of Copilot-generated tool configurations before running workflows that access production databases or external APIs.
- Configuration Restrict GenAI tool capabilities and LLM Connectivity via custom roles to limit which user populations can interact with Copilot features.
- Engineering Build a pre-run validation hook that rejects Copilot-placed tools targeting file paths or database connectors outside an approved allowlist — counters file system and credential blast from misconfigured tool placements.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Establish a policy prohibiting Copilot use with workflows handling PII, PHI, or financial data until the vendor documents output-layer data loss prevention controls.
- Configuration Configure the workflow publishing pipeline to scan output tool results for sensitive data patterns before approving publication to the server — counters the absence of output-layer DLP.
- Engineering Integrate a DLP scanning layer into the workflow execution pipeline to detect and redact sensitive data in Copilot-configured output tool targets.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require quarterly review of Copilot message history logs to identify anomalous prompt patterns, unexpected tool-placement sequences, or spikes in data sampling volume.
- Configuration Forward Copilot interaction logs to the organization's SIEM platform to enable correlation with other security event streams across the analytics environment.
- Engineering Build automated alerting on Copilot usage metrics to detect unusual connector configurations or data sampling volume changes that may indicate prompt injection attempts.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2025-15097 Alteryx Server platform auth bypass via /gallery/api/status/ (CVSS 7.3) affecting the hosting environment; not filed against Copilot directly; patched in Server 2025.1.1.1.31.
- CVE-2025-28244 Alteryx Server platform vulnerability exposing localStorage session tokens (CVSS 8.8) enabling account takeover; scoped to the Server layer rather than the Copilot feature.
- CVE-2025-63291 Alteryx Server platform IDOR via MongoDB ObjectIDs (CVSS 5.4) exposing admin API keys; applies to Server infrastructure, not the Copilot component; patched in 2024.1+.
Selected Research
- Alteryx Server Penetration Test ICT Strypes independent pentest demonstrating auth bypass and credential extraction on Alteryx Server
- Alteryx Server IDOR Advisory Independent advisory detailing IDOR allowing admin API key extraction via profile endpoint
Vendor Documentation
- Alteryx Trust Center ISO 27001 certification, SOC 2 Type II attestation, FIPS compatibility, security program overview
- Alteryx Copilot Documentation Copilot capabilities, supported tools, metadata access model, data privacy warnings
- Data Awareness Default-on real data sampling from workflow tool anchors via YXBE snapshot files
- Alteryx AI FAQs Google Gemini as LLM provider, no-training-on-customer-data policy, data retention periods
- AI Fact Sheets Copilot 90-day retention, vendor 30-day prompt retention, no local LLM data storage
- Ask Alteryx Release Notes Data Sampling capability, Gemini 2.0 Flash upgrade, incremental tool placement
Other Sources
- Agent Studio and MCP Server Agent Studio and MCP Server (Preview) enabling external AI tools to run governed workflows.
- Private Data Handling Control plane / data plane separation with opt-in customer VPC deployment.
- Alteryx Privacy Policy Corporate privacy policy confirming Copilot conversation data is retained by Alteryx and the LLM vendor, with GDPR and CCPA compliance obligations governing data subject rights.