Microsoft Copilot Prompt Injection Vulnerability
AI agents created using Microsoft Copilot Studio are vulnerable to prompt injection, allowing attackers to bypass internal security mandates. This exploit facilitates the unauthorized exfiltration of sensitive corporate data and enables malicious modification of information, posing a significant risk to organizations.
What Happened
AI agents created using Microsoft Copilot Studio are vulnerable to prompt injection, allowing attackers to bypass internal security mandates. This exploit facilitates the unauthorized exfiltration of sensitive corporate data and enables malicious modification of information, posing a significant risk to organizations.
Why This Matters
Current evidence identifies a security issue involving Microsoft Copilot, but does not yet support a more specific impact claim.
Recommended Action
No confirmed vendor remediation is available in the current evidence. Confirm whether Microsoft Copilot is present in your environment and review the affected configuration.
Exposure
Exposure unknown
Dec 11, 2025 05:30
Exposure reason: This incident does not currently match a technology in My AI Stack.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Dec 11, 2025 05:30BugSkan first recorded this incident.
-
Copilot's No Code AI Agents Liable to Leak Company Data - Dark Reading
Dec 11, 2025 05:30darkreading.com · Research
Sources
darkreading.com · Dec 11, 2025 05:30
AI agents created using Microsoft Copilot Studio are vulnerable to prompt injection, allowing attackers to bypass internal security mandates. This exploit facilitates the unauthorized exfiltration of sensitive corporate data and enables malicious modification of information, posing a significant risk to organizations.
Open publisher sourceMy AI Stack Match
Create an account to see which incidents overlap with your AI stack.