Disclosed vulnerability
CoPhish: Copilot Studio agents used as a Microsoft-hosted wrapper for OAuth consent phishing
AIR-2025-0151 AIR record · 2025-10-microsoft-cophish
From the supporting source
a Copilot Studio agent's 'Login' settings can redirect a user to any URL, including an OAuth consent attack.securitylabs.datadoghq.com
The record
Disclosed
2025-10-20
Vendor
Microsoft
Product
Microsoft Copilot Studio
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the Copilot Studio agent redirected the user into the OAuth consent attack
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Malicious agent configuration
Impact type
Credential theft, Token theft, Account takeover
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Entra ID tenants where users can consent to apps; phishing pages hosted on copilotstudio.microsoft.com
Capability abused
Defense & remediation
Recorded defense
Entra ID default app consent policy
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Microsoft announced changes to the default application consent policy in late October 2025; administrative users remained exposed
Taxonomy & references
Curator notes
Datadog Security Labs, published 2025-10-20 (updated 2025-10-28). Some press coverage described this as a 'campaign'; the Datadog writeup is a proof of concept and does not claim observed in-the-wild exploitation, so class is responsible_disclosure and impact_realized is false. The abuse of a genuine microsoft.com-hosted agent URL is what defeats URL-reputation defenses.
Supporting sources
Cite as
Enkrypt AI. "CoPhish: Copilot Studio agents used as a Microsoft-hosted wrapper for OAuth consent phishing". AIR, AIR-2025-0151. https://agentincident.vercel.app/i/AIR-2025-0151/ (accessed 2026-10-19).