Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

AgentFlayer: full customer-record exfiltration from a Copilot Studio customer-service agent via emailed prompt injection

AIR-2025-0082 AIR record · 2025-07-microsoft-copilot-studio-aijacking
Open in dashboard About
From the supporting source
Remember, if you ever set up your agent to listen to an email inbox, make sure to define the exact addresses that can trigger it. That way random attackers won’t be able to trigger your agent. Letting it listen to every email which arrives into that inbox is a recipe for disaster.labs.zenity.io
The record
Disclosed
2025-08-06
Vendor
Microsoft
Product
Microsoft Copilot Studio customer-service agent
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the Copilot Studio agent queried the CRM and emailed records out
Attack surface
Enterprise assistant
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection email
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI02 – Tool Misuse and Exploitation
MITRE ATLAS
AML.T0024 – Exfiltration via AI Inference API
NIST AI RMF
MAP 4.2
EU AI Act
Article 10
ISO/IEC
TR 24028; 23894
AIUC-1
A. Data & Privacy
Scope
tool misuse
Mitigation
Monitor network traffic for anomalous patterns; Restrict egress destinations.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Copilot Studio agents that trigger on an open inbox
Capability abused
email_triggerknowledge_source_readcrm_queryemail_send_toolknowledge_base_retrievaltool_callingoutbound_emailretrievaltool_useknowledge_source_access
Defense & remediation
Recorded defense
Copilot Studio defaults
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Microsoft acknowledged and fixed; the specific prompts no longer work
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI07 Insecure Inter-Agent CommunicationOWASP ASI02 Tool Misuse and ExploitationATLAS AML.CS0037aijackingagent_discoveryemail_triggered_agenttool_enumerationzero_clickindirect_prompt_injectionagent_hijacktool_misuseenterprise_agent
Curator notes
Zenity Labs, modelled on a McKinsey-built Copilot Studio agent Microsoft had publicly showcased. Two-part series: discovery phase then exfiltration. ATLAS dates the case study 2025-06 (month granularity); the exfiltration writeup is the Black Hat USA 2025 AgentFlayer disclosure. | Merged from duplicate id `2025-06-copilot-studio-agentflayer-exfil`. Also reported under the titles: 'AgentFlayer: AIjacking a Copilot Studio customer-service agent into full CRM data exfiltration'; 'AgentFlayer: AIjacking leads to full data exfiltration from Microsoft Copilot Studio agents'.
Supporting sources
Cite as
Enkrypt AI. "AgentFlayer: full customer-record exfiltration from a Copilot Studio customer-service agent via emailed prompt injection". AIR, AIR-2025-0082. https://agentincident.vercel.app/i/AIR-2025-0082/ (accessed 2026-10-19).