Disclosed vulnerability
Microsoft 365 Copilot generated images were accessible without authentication
AIR-2025-0001 AIR record · 2025-01-microsoft-copilot-image-idor
From the supporting source
With the rapid adoption and roll-out of new features, basic security principles are often overlooked in favor of rapid feature deployment.embracethered.com
The record
Disclosed
2025-01-02
Vendor
Microsoft
Product
Microsoft 365 Copilot (BizChat) designer_graphic_art tool
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — a plain IDOR in the storage of the image tool's output
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Insecure direct object reference
Impact type
Unauthorized data access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
enterprise M365 Copilot tenants generating images
Capability abused
Defense & remediation
Recorded defense
none on the generated-image URLs
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed by mid-December 2024; reported to MSRC late September 2024
Taxonomy & references
Curator notes
Not a prompt-injection bug: a plain authorization failure in the storage of an agent tool's output.
Supporting sources
Cite as
Enkrypt AI. "Microsoft 365 Copilot generated images were accessible without authentication". AIR, AIR-2025-0001. https://agentincident.vercel.app/i/AIR-2025-0001/ (accessed 2026-10-19).