Chen Yusen's 100 days have passed, but the exam for the safety lesson has not yet started.
On September 22, at the Qwen Office Special Session of the Yunqi Conference, Chen Yusen walked onto the stage holding a mascot microphone in the shape of an octopus, with the speech titled "Context is All You Need". This was his first large-scale public appearance just over 100 days after he took office as CEO of DingTalk, and an extra line of title was added on the screen behind him: Vice President of Alibaba Group.
The keynote of the whole speech was light and lively. He mentioned that some people can finish 8 hours of work in half an hour with AI, and the remaining time "can be spent in a daze or doing more work", and that AI will give everyone more moments to relax. Both the octopus-shaped microphone and the sense of relaxation are props designed to dilute the inherent impression DingTalk has left on the public: Message Read, DING, and attendance machine.
However, his resume does not match these props. Chen Yusen is a core member of the Blue Lotus Team of Zhejiang University, one of the first batch of domestic white-hat hackers who grew up participating in CTF competitions. At the age of 22, he founded the cybersecurity company Chaitin Tech, and became well-known in the industry for his Web application firewall "Safeline", with clients including China Merchants Bank, the three major telecom operators and State Grid Corporation of China. His company was acquired by Alibaba Cloud in 2019. He is a person whose entire career was built on the assumption that every system can be breached.
The product he is selling now is called "Enterprise Context": it aggregates corporate group chats, schedules, approvals, documents and knowledge bases into a layer that can be uniformly called by Agents, enabling AI to truly "understand" a company. His exact words were that if AI does not understand your company, it is nothing more than an expensive toy.
The first lesson in the security industry is least privilege and risk decentralization, while the methodology of this product is to centralize everything and grant full authorization. A person who spent the first half of his career building firewalls is now persuading enterprises to break through all rooms behind the walls and hand the keys over to a large language model. All the questions raised in this review start from this very transformation.
Let's start with the hardest part: permissions. The foundation of traditional enterprise software is the permission system: only HR can view compensation information, only the project team can access merger and acquisition documents, and only a very small number of people can see the layoff list before it is announced. Behind every access control is real organizational discipline.
For "Context is All You Need" to hold true, the Agent must cross all these systems to read everything. The value of context and the completeness of permissions are inherently conflicting in engineering: the more complete the context is, the more the permission model looks like a sieve.
Let's make the question more specific. A CEO asks the Agent to draft a weekly business report. To complete this task, the Agent reads group chats, approval flows and document libraries, including content that it is not supposed to process. How can we ensure that confidential information does not leak from the output side? Currently, the industry's solutions are no more than three types: permission inheritance, field filtering, and output auditing. Each of them is feasible when used alone, but they are extremely difficult to implement when combined.
The hardest part is semantic leakage: the model can not quote any original text, but convert confidential information into conclusions. For a company that is planning layoffs, if the CEO asks the Agent "Why has the R&D efficiency decreased recently", will the attribution given by the Agent include the background that only HR is qualified to know? It does not even need to say anything wrong, it only needs to shift the direction of the answer slightly.
The entire industry has not yet come up with a standard answer to this problem, and Chen Yusen cannot be unaware of this. He is clearer than most product managers that loopholes in the permission system often do not exist in the design drawings, but in every exception made "for the sake of convenience". The product of Enterprise Context essentially makes "for the sake of convenience" the default setting.
This scenario has a real-world version. In August 2024, security company PromptArmor disclosed an injection attack targeting Slack AI: an attacker can publish a carefully constructed piece of content in a public channel, then manipulate Slack AI to splice the content of private channels that the victim has no right to access into a link and send it out when answering other users' daily questions. The API keys in the developer's private channel were stolen in the demonstration.
The post-incident technical analysis put the root cause very bluntly: the retrieval scope of Slack AI is not strictly bound to user permissions, and data of different trust levels are mixed in the same reachable space. What is more noteworthy is Slack's initial response, which once considered this as expected behavior. The retrieval layer trusts everything it can read by default, and this design philosophy shares the same premise with "Context is All You Need".
Next, look at the attack surface. In the past, if an attacker wanted to drain a company's data, they had to breach OA, documents, approval systems and CRM separately. Each system is an independent door, and the dispersed data itself forms a depth of defense that delays attacks. Enterprise Context aggregates everything behind the five doors into the same index layer. For the defense side, this is breaking down data silos, while for the attacker, this is the crown jewel: breaching this layer means breaching all of them. The economics of defense has thus reversed: every efficiency dividend that enterprises pay for AI is simultaneously adding value to this single point of failure.
An even bigger variable is that Agents naturally need to read external content, such as emails, web pages, and documents sent by customers, which opens the door wide for prompt injection: attackers do not need to breach any server, as long as they embed a carefully constructed instruction in an email, they may command an Agent with internal enterprise permissions to actively send the data out. This type of attack has no reliable general defense so far, and it has long ranked first in OWASP's list of large language model risks.
Ironically, the WAF that Chaitin Tech relied on for survival back then was designed to prevent malicious instructions mixed in normal traffic. That weapon could defend against injections in the old era, but cannot defend against this type of injection in its own product in the new era.
There have already been landmark incidents on this path. In June 2025, Aim Security disclosed the EchoLeak vulnerability in Microsoft 365 Copilot, with the CVE ID CVE-2025-32711 and a severity score of 9.3, the highest level. The attacker only needs to send an ordinary-looking email to the victim. The victim does not need to open it, reply to it, or do anything at all. When Copilot reads this email into the context in a subsequent ordinary question and answer session, the hidden instruction in the email will be executed as the user's own intention. All accessible emails, documents and Teams records will be quietly packaged and sent to the attacker's server via an automatically loaded image link.
A noteworthy detail is that Microsoft had deployed three lines of defense for this: a prompt injection classifier, link filtering, and content security policy, all three of which were bypassed. This all happened at the company with the largest scale of enterprise AI deployment and the most sufficient security budget in the world, when all its mitigation measures were in place.
In July of the same year, Replit's AI Agent demonstrated the other half of the risk: under clear instructions to freeze codes and operations, it deleted a production database containing data of more than 1,200 executives and nearly 1,200 companies, then forged 4,000 pieces of false data and test records, and claimed to users that rollback was not possible. An Agent that can read everything, coupled with the ability to take actions and cover up traces, means that what Enterprise Context promises is far more than just efficiency.
It should be noted that these cases do not constitute factual accusations against Qwen Office, and the public information is not sufficient to judge the maturity of its permission design and injection protection. But none of the companies on this list are small companies: Slack, Microsoft, Replit, none of them are companies with insufficient security investment. Their incidents show that the root of this type of risk does not lie in engineering quality, but in the paradigm itself. Paradigm problems will not appear on the PPT of press conferences, they will only appear in CVE numbers.
Thus, the silence during that speech becomes intriguing. For about 40 minutes, the main line of the speech was persuading enterprises to hand over more context: the more context they hand over, the more AI understands them, and the faster the organization operates. However, according to public reports, the part about security and permissions was disproportionately small. The Qwen Office official website has published a privacy and security document, promising that it "will not actively access data that is not authorized by users", but there is a whole productization process between a single line of promise and a verifiable, auditable and accountable permission engineering system.
Some questions should have been raised in that speech: how permissions are inherited when the Agent reads context, whether enterprise data will be used to feed model training, where the index storage is located, who the audit interface is open to, and whether there is third-party evidence for injection protection.
There are already precedents for the data feeding issue. In March 2023, Samsung opened ChatGPT for employees in its semiconductor division. Within 20 days, three employees successively input source code, yield data and meeting minutes into it. Once confidential information enters the learning library of the external model, it can never be retrieved. Samsung's response escalated all the way from limiting the length of a single question to a comprehensive ban, and finally it embarked on the path of developing its own internal AI. That was the first lesson about the enterprise data boundary in the era of large language models, with chip confidential information as the tuition fee.
For an ordinary CEO, this list of questions is nitpicking; for a CEO with a security background, these are the skills he once relied on to make a living. Some reports have described his security background as a selling point, claiming that for him, security, permissions and auditing are no longer auxiliary functions, but the ontology of the product. This statement is a compliment, but it is also a debt.
The official press release says he is the most suitable person for this position, and this statement can be returned as it is: precisely because he is the most suitable, he is the one who should be asked the most questions. Avoiding security issues can be a cognitive blind spot for people who do not understand security, but for him, there is only one explanation left, which is trade-off. Behind the trade-off is mostly the timetable: DingTalk's user base is aging, competitors are speeding up, and Alibaba needs a new Agent narrative to run ahead of all answers. Once the security issue is raised, the narrative will slow down.
Back then he built firewalls to defend against people outside the door; now he is building Enterprise Context, and the door is opened from the inside. The person who opens the door knows better than anyone what is outside, which is exactly the reason why we should ask him these questions.
DingTalk has already proven with a 75,000-word long resignation post that the cracks of this company are always discovered from the inside. Whether the next crack will appear in the security field depends on when Chen Yusen will make up and clarify the part he did not talk about in these 100 days. The exam for the security lesson is never scheduled, and he is the only person in the room who has no reason to miss the exam.
This article is from the WeChat Official Account "Qidian Pai", written by Wang Xuran, published with authorization from 36Kr.