Copilot Studio and Microsoft 365 Copilot Vulnerabilities: Known Agent Attacks and CVEs (2024–2026)

In January 2026, Microsoft published CVE-2026-21520 for a Copilot Studio agent that a SharePoint form could take over. Capsule Security, which reported it, showed that a crafted value in a form's free-text field could make the agent read a connected SharePoint list and email customer records to an outside address. During testing, Capsule saw Microsoft's safety mechanisms flag the request while the data still left (ShareLeak write-up). It was the first Copilot Studio CVE for agent prompt injection.

This page is a dated record of public attacks on Microsoft's agent platforms: Copilot Studio, Microsoft 365 Copilot (the runtime that Agent Builder agents use), and Microsoft Foundry, formerly Azure AI Foundry. It shows what has been demonstrated, what Microsoft fixed, and what stays the customer's job. General Analysis didn't discover these issues. Each entry summarizes the researchers' write-ups and Microsoft Security Response Center (MSRC) records, checked November 6, 2026.

Timeline of attacks on Microsoft agent platforms#

1. Aug 2024Copilot Studio SSRFTenable reached cloud metadata and internal Cosmos DB keysCVE-2024-38206CVSS 8.5
2. Nov 2024Copilot Studio cross-site scriptingElevation of privilegeCVE-2024-49038CVSS 9.3
3. Jun 2025EchoLeakAim Labs: zero-click email injection exfiltrated contextCVE-2025-32711CVSS 9.3
4. Jan 2026ShareLeakCapsule Security: a form-triggered agent emailed SharePoint records outCVE-2026-21520CVSS 7.5
5. Mar 2026Summary phishingPermiso: hidden email text made summaries show phishing alertsCVE-2026-26133CVSS 7.1
6. May 2026Copirate 365Johann Rehberger: exfiltration through CSS and font requests, plus memory poisoningCVE-2026-24299CVSS 5.3
7. Jun 2026SearchLeakVaronis: a one-click URL prompt exfiltrated through a Bing fetcher in Copilot SearchCVE-2026-42824CVSS 6.5
8. Aug 2026ChatMateRubrik Zero Labs: an injected document escaped the code interpreter sandbox to the hostCVE-2026-32193CVSS 8.8

The eight disclosures from the table below that received CVEs, in order. Thirteen others had no CVE.

Server-side CVEs without public write-ups are listed in the Foundry and Copilot Studio sections below.

Copilot Studio attacks#

SSRF to cloud credentials (CVE-2024-38206)#

Tenable used Copilot Studio's HTTP request action to reach the cloud instance metadata service. A direct request was blocked; a redirect from an attacker-controlled server got through, and header manipulation made the metadata service answer. Tenable obtained managed-identity tokens and Cosmos DB keys for internal resources (Tenable). Microsoft rated it critical and fixed it with no customer action.

Public bots and maker credentials (Zenity, 2024 and 2026)#

At Black Hat USA 2024, Zenity's 15 Ways to Break Your Copilot covered unauthenticated chat, oversharing through channels, hardcoded credentials, and "Copilot author authentication," which lets other users act with the maker's access. Its CopilotHunter tool scanned for public Copilot Studio bots. In January 2026, Zenity's Agentic Recon showed how to derive an agent's URL from public information, test whether it allows unauthenticated chat, and enumerate its tools and knowledge sources. Zenity said it had found thousands of explorable public Copilot Studio bots the previous year; its 2025 AgentFlayer research put the number that would reveal their tools at more than 3,000. The 2026 method enumerated tens of thousands of existing agents, without saying how many were open. New agents now default to Microsoft authentication, but makers can still choose none.

AgentFlayer: an email-triggered agent leaks its CRM (Zenity, 2025)#

Zenity rebuilt a customer-service agent that Microsoft had showcased, with an email trigger that accepted mail from any sender, a knowledge file, a Salesforce lookup tool, and a send-email tool. Injected emails made the agent reveal its tool names, email its knowledge file, and email CRM records to the attacker, with no user interaction (Zenity). Microsoft fixed the report in April 2025 and paid a bounty. Zenity believes the fix mainly blocks known payloads and that the agent design remains injectable.

CoPhish: OAuth consent phishing through an agent (Datadog, 2025)#

Datadog Security Labs showed an attacker-built agent whose sign-in used "Authenticate manually" with a malicious app registration. An HTTP request in the sign-in topic forwarded the user's access token to the attacker, and the agent was shared through its demo website on copilotstudio.microsoft.com, so the phishing page sat on a Microsoft domain (Datadog). Datadog notes that administrators aren't bound by user-consent policy. No CVE was issued; mitigation is tenant consent policy, restricting app registration, and monitoring agent creation and sign-in topic changes.

The travel agent that set a trip to $0 (Tenable, 2025)#

Tenable built a Copilot Studio travel agent over SharePoint test data with get, create, and update tools. A prompt injection made the agent list its actions, passing several reservation IDs returned several customers' card data, and an update permission meant for travel dates also covered the price field (Tenable). No fix applies: the agent did what its tools allowed.

Connected agents (Zenity, 2025)#

New Copilot Studio agents have "Let other agents connect to and use this one" turned on by default, and Microsoft's documentation confirms that any agent in the same environment can connect by default (Microsoft Learn). Zenity showed an insider connecting a rogue agent to a support agent and sending mail through its email tool from the company's address. Only the calling agent recorded the invocation (Zenity).

ShareLeak (CVE-2026-21520)#

Described at the top of this page. MSRC classifies it as information disclosure with CVSS 7.5, and Capsule says the fix was deployed on January 15, 2026. Capsule's recommendations are least privilege for agent tools, control over actions before they run, and human approval for external communication.

Sandbox escape and logging gaps#

At DEF CON 34 in August 2026, BeyondTrust's Phantom Labs presented an escape from Copilot Studio's code interpreter. According to the talk's abstract, the interpreter runs in a Windows container on Azure Service Fabric, inside a Python sandbox guarded by a small safety model. The researchers bypassed the sandbox's filters, escaped through the Python-to-.NET bridge, and reached TLS private keys, environment variables including Azure AD client IDs, the application's source code, and command execution. We found no Microsoft response or matching CVE.

Datadog Security Labs found that four Copilot Studio admin events, covering authentication changes, publishing, sharing, and Application Insights changes, weren't logged from at least August 29 to September 25, 2025. Microsoft fixed it by October 5, but Datadog later saw two events logging inconsistently again, and noted that unauthenticated chats produce no CopilotInteraction audit event (Datadog). Verify your audit trail with test changes rather than assuming it's complete.

Copilot Studio CVEs with MSRC records but no public write-up: CVE-2024-43610 (information disclosure, 7.4), CVE-2024-49038 (cross-site scripting to elevation of privilege, 9.3), and CVE-2026-80098 (improper signature verification, 9.3). All were fixed server-side.

Microsoft 365 Copilot attacks that reach Agent Builder agents#

Agent Builder agents run on Microsoft 365 Copilot's orchestrator, renderers, and memory, so these attacks show which channels those agents inherit.

EchoLeak (CVE-2025-32711)#

Aim Labs sent an email phrased as instructions to the human recipient, which slipped past the cross-prompt injection classifiers. When the victim later asked Copilot something that retrieved the email, reference-style markdown images auto-fetched attacker URLs through Microsoft domains on the browser's allow list, carrying data out without a click. Aim called the technique an "LLM scope violation" (MSRC). Microsoft fixed it server-side and said customers needed no action.

Mermaid diagrams, CSS, and fonts#

Each rendering fix moved exfiltration somewhere else. Adam Logue encoded mail into a clickable Mermaid diagram in 2025, fixed by removing interactive links (Logue). Johann Rehberger's Copirate 365 used CSS backgrounds and web fonts in Copilot's HTML preview, and injected documents wrote persistent memories (Embrace The Red, CVE-2026-24299). Varonis's SearchLeak used a URL parameter as a prompt, an image tag that fired before the sanitizer, and a Bing image endpoint that fetched attacker URLs (Varonis, CVE-2026-42824).

Summary phishing (CVE-2026-26133)#

Permiso hid text in an ordinary email that made Copilot's summary show a fake security alert with a link (Permiso). Unlike most entries here, the MSRC record marks customer action as required and lists fixed builds of Outlook, Teams, Office apps, and the Copilot mobile and Mac apps.

ChatMate: from a Word document to the host#

Rubrik Zero Labs used hidden instructions in a Word document to run attacker Python in Copilot's code interpreter, escalated to root in the sandbox, then escaped to the Kubernetes node through bugs in a container runtime daemon. With internet access from the node, the researcher could send prompts into the victim's live Copilot session (Rubrik). Microsoft fixed the chain by April 2026; CVE-2026-32193 covers the Azure Kubernetes Service bug and required action from AKS customers.

Memory poisoning in the wild#

In February 2026, Microsoft reported "Summarize with AI" buttons and links that open assistants with a pre-filled prompt telling them to remember a company as a trusted source. Over 60 days of email URL telemetry, it found 50 such prompts from 31 companies across 14 industries, aimed at several assistants, with effectiveness varying by platform (Microsoft Security). It's the only prompt-based technique in this record documented in real use.

CVEs that needed customer action#

Most Microsoft 365 Copilot fixes were server-side, but several MSRC records list customer action. CVE-2026-55145, an Outlook Copilot tampering flaw, names external sender tagging (Set-ExternalInOutlook) as the control that lets Microsoft isolate untrusted mail before Copilot sees it. CVE-2026-26144, an Excel cross-site scripting flaw, could make Copilot's Agent mode exfiltrate data without user interaction and required an Office update. CVE-2026-42893 and CVE-2026-58617 required updates to Outlook for iOS and the Microsoft 365 Copilot iOS app.

Microsoft Foundry and Azure OpenAI#

Foundry has no public prompt injection CVE yet. Its public record is mostly service bugs:

All were fixed server-side with no customer action, and none has a public technical write-up. Four of the seven are server-side request forgery, the same class Tenable found in Copilot Studio in 2024. Customers can't patch these; they can limit what the platform's managed and agent identities can reach.

The closest thing to a Foundry agent attack write-up is a vendor demonstration: Zenity built a Foundry support agent triggered by email, with a Salesforce lookup and a send-email tool, and reported that encoded instructions got past content filtering and Prompt Shields to email CRM data out (Zenity). And on November 5, 2026, Microsoft Threat Intelligence reported attackers using agentic tooling to harvest exposed secrets from code repositories, including AI service keys and OAuth apps with access to Foundry Tools (Microsoft Security).

Three other Foundry-adjacent findings need customer attention. Mindgard bypassed Azure AI Content Safety's Prompt Shields in 2024 with character injection (Mindgard); those numbers describe 2024 classifiers, not today's. Palo Alto Networks Unit 42 showed that Foundry's model catalog could deploy a model whose deleted Hugging Face namespace an attacker had re-registered (Unit 42); pin and clone models. And the Prompt flow fix for CVE-2025-24986 required package upgrades.

Entra Agent ID#

Copilot Studio and Foundry now give agents Microsoft Entra agent identities, which created a new target. Silverfort found that the Agent ID Administrator role could add itself as owner of ordinary service principals and sign in as them; Microsoft fixed the role's scope in April 2026 (Silverfort). Compass Security and Datadog Security Labs then analyzed the design: credentials live on the blueprint, so anyone who can add a credential to a blueprint can act as every agent identity created from it, in every tenant where it's used (Compass Security, Datadog). Treat blueprint owners, Agent ID Administrators, and AI Administrators as highly privileged.

What these attacks have in common#

Four patterns repeat across the record.

Untrusted content reaches a privileged agent. Email (EchoLeak, AgentFlayer, Permiso), SharePoint forms and documents (ShareLeak, ChatMate), URL parameters (SearchLeak, recommendation poisoning), public agent endpoints (Agentic Recon), and other agents (connected agents) all delivered instructions. Our IPI Bench research measured the same channel class across frontier models: one to three injected records sent by email, calendar invitation, or public post achieved the attacker's goal in 4.8% to 38.5% of single attempts, depending on the model.

Exfiltration moves from renderers to tools. Microsoft closed each rendering channel deterministically: markdown images, diagram links, HTML preview requests. Exfiltration through tools the agent is supposed to use, such as send-email, HTTP requests, and record updates, is harder to close because it looks like normal work.

The maker's configuration carries the risk. Every Copilot Studio agent attack used something the maker had set up: an open email trigger, a send-email tool, broad write scopes, manual authentication, connected-agent access, or no authentication. These aren't patchable vulnerabilities.

Classifiers help but don't hold alone. EchoLeak evaded cross-prompt injection classifiers, Mindgard evaded Prompt Shields, and ShareLeak was flagged without being stopped. The controls that held were deterministic: blocking a channel, requiring authentication through policy, removing a rendering path, or requiring approval.

All of the injection patterns also fall under LLM01 Prompt Injection. Our guides to the OWASP Top 10 for Agentic Applications and the OWASP LLM Top 10 2026 cover the categories in depth.

How to test your own agents against these attacks#

Reproduce the channel, not the payload. Published payloads are what Microsoft's classifiers learned to block, so a test that replays them mostly measures that. A useful test sends injected content through each input the agent actually reads: its email trigger, its SharePoint forms and lists, the documents in its knowledge sources, and any agent that can connect to it. Then check outcomes at the tool level: did a record change, did an email leave, did an HTTP request go out?

Run each case more than once. IPI Bench found attack success rising sharply with repeated attempts, so a single clean run says little. Finally, confirm that the deterministic controls you rely on, such as data policy blocks, recipient limits, and approvals, still fire when the model has been convinced.

For platform-specific hardening, see Copilot Studio security, Microsoft Foundry agent security, and Agent Builder security. For platform choice, see Agent Builder vs Copilot Studio vs Foundry.

How General Analysis helps#

General Analysis runs these attack patterns against your own Copilot Studio, Agent Builder, and Foundry agents, through the triggers and knowledge sources they actually use. Automated AI red teaming reports which tool actions an attacker could cause, and AI detection and response watches for the same patterns in production.