A Praxis care coordinator asks for a routine patient visit summary. A record retrieved to answer it contains a hidden instruction, planted in a free-text field by a third-party referral system, attempting to redirect the LLM into exporting the patient's full history externally. The domain's sharpest and highest-stakes scenario — grounded on the real Copilot Studio / Agentforce incidents identified during research — and the reason CAP-D24 exists as its own capability rather than folded into generic prompt moderation.
Renee Castillo asks for a summary of a patient's recent visits across Bellwood's still-separate EHR, a routine, daily-driver request.
Single request, sub-second on the platform side, invisible to Renee entirely