Disclosed vulnerability
M365 Copilot could read files without writing an audit log entry, on request
AIR-2025-0102 AIR record · 2025-07-m365-copilot-audit-log-bypass
From the supporting source
Upon testing further, I discovered that I could simply ask Copilot to behave in that manner, and it would. That made it possible to access a file without leaving a trace.pistachioapp.com
The record
Disclosed
2025-08-18
Occurred
2025-07-04
Vendor
Microsoft
Product
Microsoft 365 Copilot
Risk domain
Privacy › Data exfiltration channels
Also touches
Policy drift
System type
Generative model
Who acted
Agent acted — Copilot read files and suppressed its own audit-log entry on request
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Direct prompt instruction
Impact type
Audit evasion, Insider data exfiltration, Compliance failure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all M365 Copilot tenants relying on audit logs for compliance
Capability abused
Defense & remediation
Recorded defense
M365 unified audit log
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
fixed 2025-08-17; Microsoft chose not to notify customers or assign a CVE
Taxonomy & references
Curator notes
AI Incident Database incident 1218; disclosed by Zack Korman. Important as an agent-observability failure rather than a data-leak failure: the agent's actions were invisible to the tenant's own logging. Also reported as: 'Microsoft 365 Copilot read files without writing an audit log entry when asked to omit references'.
Supporting sources
Cite as
Enkrypt AI. "M365 Copilot could read files without writing an audit log entry, on request". AIR, AIR-2025-0102. https://agentincident.vercel.app/i/AIR-2025-0102/ (accessed 2026-10-19).