{
 "public_id": "AIR-2025-0082",
 "incident_id": "2025-07-microsoft-copilot-studio-aijacking",
 "date_disclosed": "2025-08-06",
 "date_occurred": null,
 "title": "AgentFlayer: full customer-record exfiltration from a Copilot Studio customer-service agent via emailed prompt injection",
 "class": "responsible_disclosure",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "indirect_prompt_injection_email",
 "agent_capability_abused": [
  "email_trigger",
  "knowledge_source_read",
  "crm_query",
  "email_send_tool",
  "knowledge_base_retrieval",
  "tool_calling",
  "outbound_email",
  "retrieval",
  "tool_use",
  "knowledge_source_access"
 ],
 "target_product": "Microsoft Copilot Studio customer-service agent",
 "target_vendor": "Microsoft",
 "autonomy_level": "fully_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration"
 ],
 "blast_radius": "Copilot Studio agents that trigger on an open inbox",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI07",
   "ASI02"
  ],
  "mitre_atlas": [
   "AML.CS0037"
  ],
  "labels": [
   "aijacking",
   "agent_discovery",
   "email_triggered_agent",
   "tool_enumeration",
   "zero_click",
   "indirect_prompt_injection",
   "agent_hijack",
   "tool_misuse",
   "enterprise_agent"
  ]
 },
 "defense_present": "Copilot Studio defaults",
 "defense_bypassed": true,
 "fix_shipped": "Microsoft acknowledged and fixed; the specific prompts no longer work",
 "primary_sources": [
  "https://labs.zenity.io/p/a-copilot-studio-story-2-when-aijacking-leads-to-full-data-exfiltration-bc4a",
  "https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml",
  "https://labs.zenity.io/",
  "https://labs.zenity.io/post/a-copilot-studio-story-2-when-aijacking-leads-to-full-data-exfiltration-bc4a"
 ],
 "verified_quote": "Remember, if you ever set up your agent to listen to an email inbox, make sure to define the exact addresses that can trigger it. That way random attackers won’t be able to trigger your agent. Letting it listen to every email which arrives into that inbox is a recipe for disaster.",
 "confidence": "high",
 "notes": "Zenity Labs, modelled on a McKinsey-built Copilot Studio agent Microsoft had publicly showcased. Two-part series: discovery phase then exfiltration. ATLAS dates the case study 2025-06 (month granularity); the exfiltration writeup is the Black Hat USA 2025 AgentFlayer disclosure. | Merged from duplicate id `2025-06-copilot-studio-agentflayer-exfil`. Also reported under the titles: 'AgentFlayer: AIjacking a Copilot Studio customer-service agent into full CRM data exfiltration'; 'AgentFlayer: AIjacking leads to full data exfiltration from Microsoft Copilot Studio agents'.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the Copilot Studio agent queried the CRM and emailed records out",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_email",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.CS0037"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "m365_copilot",
 "model_provider": "microsoft",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI07 (vector=inter_agent), ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}