Six months after deploying a Copilot agent, the underlying model is upgraded by GitHub, two new tool integrations are added, and the agent's task scope is expanded to include writing release notes. The security team has not performed a review since the initial deployment. At which point in this lifecycle should a security review have been triggered?
Select an answer to reveal the explanation.
Short Explanation and Infographic
An agent's security profile isn't just its code—it's the model, the tools, and the scope of what it can affect. Each of these changed. Think of it like re-certifying a pilot every time they switch aircraft type, add new avionics, or fly new routes. Change events, not just calendars or incidents, should trigger security reviews.
Full explanation below image
Full Explanation
Agent lifecycle security reviews should be event-driven, not just time-based. Each of the following events in the scenario represents a meaningful change to the agent's security attack surface:
1. Model upgrade: A new model version may have different capability levels, respond differently to adversarial inputs, have updated tool-use behavior, or interpret instructions differently. The security properties of the previous model may not carry over.
2. New tool integrations (×2): Each new tool expands what the agent can do if compromised or manipulated. Each tool integration requires its own threat model: What can this tool read? Write? Delete? What happens if it receives a malicious response?
3. Scope expansion (release notes): The agent now has access to additional context (release information) and creates content that goes into product communications. This introduces new risks around information leakage and content manipulation.
Option A (only code changes) is incorrect because the threat model encompasses the model, tools, and scope—not just the agent's source code. Option C (annual schedule) is better than nothing, but event-driven reviews catch issues as they are introduced rather than months later. Option D (incident-driven reviews) is reactive rather than proactive—by the time an incident occurs, the damage is already done. Responsible AI lifecycle management requires reviews at change events.