Navigating Security Risks in Microsoft Copilot Studio

A walk through the key security issues in Microsoft Copilot Studio, organized using the Cloud Security Alliance’s MAESTRO threat-modeling framework.

Copilot Studio is Microsoft’s low-code platform for building AI agents. The pitch is seductive: in an afternoon, someone who has never written a line of code can stand up an agent, wire it to SharePoint, Outlook, Teams, Dataverse, or any HTTP endpoint, give it some instructions in plain English, and publish it to a website or straight into Microsoft 365 Copilot.

That accessibility is exactly what makes it powerful — and exactly what makes it a security problem. When anyone can build an autonomous agent that reads real data and takes real actions under real identities, you have democratized both productivity and risk at the same time.

To think about this clearly, I like the MAESTRO framework from the Cloud Security Alliance. It breaks an agentic system into seven layers, from the model at the bottom to the multi-agent ecosystem at the top, and forces you to ask “what could go wrong here?” at each one. The discipline of walking every layer is the point — most “nothing comes to mind for this layer” reactions just mean you haven’t looked hard enough.

So let’s walk all seven.

Layer 1 — Foundation Models

The model underneath is susceptible to prompt injection and goal manipulation, full stop. No amount of low-code polish changes that.

Scenario: Tenable’s research team showed that a straightforward prompt injection could push a Copilot Studio agent into violating its core instructions — coughing up multiple customer records (including credit card data) or approving a “free vacation” booking. The agent did what it was persuaded to do, not what it was built to do.

This gets worse when the agent’s instructions are thin. Microsoft’s own security team has flagged that agents using generative orchestration without well-defined instructions are far more prone to drifting, taking unexpected reasoning paths, and interacting with connected systems in ways nobody planned. Vague instructions are a configuration vulnerability, not just a quality issue.

What helps: Treat the system prompt and instructions as a security control. Be explicit and restrictive about what the agent may and may not do, and test it against adversarial inputs before you publish.

Layer 2 — Data Operations

This is where data flows in and out — and where most of the headline incidents have lived. The dangerous pattern is indirect prompt injection: hostile instructions hidden inside the content the agent retrieves, rather than typed by the user.

Scenario: The marquee example is EchoLeak, disclosed by Aim Security in June 2025 — billed as the first “zero-click” attack on an AI agent. An attacker plants malicious instructions in content the agent will later read (an email, a document), and the agent exfiltrates data without the victim ever clicking anything. Microsoft calls this class of attack XPIA — cross-prompt injection via connected data sources.

The exfiltration path matters too. The HTTP connector in Copilot Studio can, by design, reach outside the tenant in ways that sidestep Power Platform’s tenant isolation — which turns “the agent read a poisoned doc” into “the agent quietly shipped data to an external endpoint.”

What helps: Constrain which data sources an agent can read, apply data-loss-prevention policies to connectors, and be deeply suspicious of any agent that can both read sensitive content and call arbitrary external URLs.

Layer 3 — Agent Frameworks

This is the orchestration layer: how topics, actions, and tool calls get sequenced. Bugs here are about the agent’s logic, not the model’s knowledge.

Scenario: In January 2026, Microsoft assigned CVE-2026-21520 to a Copilot Studio prompt-injection vulnerability and shipped a patch. The uncomfortable footnote: in follow-up testing by Capsule Security, data could still be exfiltrated through the same vulnerability class via a different path. A file-level guardrail meant to restrict which files an agent could touch was reasoned around by the agent itself, which simply found another route to the same data. Patching one entry point doesn’t close the class.

What helps: Don’t trust a single guardrail to hold. Assume the orchestrator can find creative paths, and put limits at the data and identity layers, not just inside the agent’s logic.

Layer 4 — Deployment Infrastructure

How and where the thing is hosted. Even a “no-code” product is running on real infrastructure with real flaws.

Scenario: CVE-2024-38206 was a server-side request forgery (SSRF) bug in Copilot Studio itself, rated CVSS 8.5, that let researchers reach Microsoft’s own internal infrastructure. That’s a reminder that the platform is part of your attack surface, not just the agents you build on it. Add to this the secrets-handling question: connectors hold credentials, and a misconfigured connector is a credential exposure waiting to happen.

What helps: Stay current on platform CVEs, inventory which connectors hold which secrets, and minimize standing credentials wherever possible.

Layer 5 — Evaluation and Observability

You can’t respond to what you can’t see — and Copilot Studio’s visibility has had real gaps.

Scenario: Between August and September 2025, several critical administrative actions in Copilot Studio reportedly generated zero audit records — including disabling authentication and removing logging. Think about that ordering for a second: the actions an attacker would most want to take are precisely the ones that left no trace. If turning off the lights doesn’t show up in the logs, your monitoring has a blind spot exactly where it hurts.

What helps: Verify that agent creation, configuration changes, and tool invocations are actually being logged — don’t assume the platform captures everything. Microsoft’s Defender community hunting queries are a reasonable starting point for detecting common misconfigurations.

Layer 6 — Security and Compliance

Policy enforcement, identity, and privilege. This is where Copilot Studio’s defaults bite hardest.

Scenario — the confused deputy: By default, a Copilot Studio agent runs with the maker’s credentials. So when a low-privilege user chats with an agent built by an admin, the agent acts with the admin’s data access. Every user effectively borrows the maker’s reach. This is a textbook confused-deputy problem, baked into the default.

Scenario — CoPhish: Because agents can live on the legitimate copilotstudio.microsoft.com domain, attackers have a credible surface for OAuth-style phishing that looks entirely authentic to the victim. The trustworthy domain becomes the lure.

What helps: Configure agents to use the invoking user’s identity rather than the maker’s wherever possible, scope connector permissions to the minimum, and require human approval for any write, financial, or irreversible action.

Layer 7 — Agent Ecosystem

The top layer: what happens when agents talk to other agents, share tools, and depend on a supply chain.

Scenario: Copilot Studio’s Connected Agents feature lets one agent hand off to another — which opens a path for cross-agent lateral movement, where a compromised or manipulated agent pivots through its peers. Layer on the supply-chain angle (third-party connectors, shared tool definitions, MCP servers) and memory/context poisoning that can persist across sessions, and you get failure modes that look nothing like a classic application breach. Microsoft’s own mapping to the OWASP Agentic AI Top 10 names rogue agents and cascading failures as first-class risks for exactly this reason.

What helps: Review every Connected Agents relationship as a trust boundary, vet third-party connectors and tools the way you’d vet any dependency, and don’t let agents accumulate memory you can’t inspect or reset.

The threats that don’t fit your old playbook

If you map all of the above against traditional security controls, a handful of them simply don’t have a natural home:

Indirect prompt injection (poisoned content steering the agent) — your firewall and DLP weren’t designed for instructions hidden in a calendar invite.
Confused deputy via credential inheritance — identity governance assumes a user acts as themselves, not as whoever built the tool.
Cross-agent lateral movement — your network segmentation doesn’t see agent-to-agent handoffs.
Memory and context poisoning — there’s no antivirus for a corrupted embedding store.

These are the ones worth the most attention, because they need new thinking — better instructions, identity scoping, agent-aware monitoring — not just turning the old controls up louder.

A short hardening checklist

If you’re running Copilot Studio (or thinking about it), this is roughly where I’d start:

Write real instructions. Treat them as a control, and red-team them.
Scope connector permissions to the absolute minimum each agent needs.
Fix the identity default — run agents as the invoking user, not the maker.
Lock down the HTTP connector and watch for outbound exfiltration paths.
Apply DLP to data sources and connectors.
Confirm audit logging actually works for agent creation, config changes, and tool calls.
Require human approval for write, financial, and irreversible actions.
Restrict who can publish agents in the first place.
Treat Connected Agents and third-party tools as trust boundaries.
Inventory and govern agent memory.

The takeaway

Copilot Studio isn’t uniquely insecure — most of these issues are inherent to agentic AI, and Microsoft has been shipping detections and guidance steadily. What’s different is who is building agents and how fast. When a low-code tool puts autonomous, data-connected, action-taking agents in the hands of every employee, the security model has to shift from “secure the app” to “treat every agent as a privileged identity with a scoped job and a watchful eye on it.”

Walk the layers, assume the prompt is hostile, and never give an agent more reach than the task actually requires.

Sources and further reading

Tenable — Copilot Studio Security: how a simple prompt injection leaked sensitive data
Microsoft Security Blog — Addressing the OWASP Top 10 Risks in Agentic AI with Copilot Studio and Detecting and mitigating common agent misconfigurations
VentureBeat — Microsoft patched a Copilot Studio prompt injection (CVE-2026-21520). The data exfiltrated anyway.
Aim Security — EchoLeak: the first zero-click attack on an AI agent
BeyondScale — Microsoft Copilot Studio Security: Enterprise Admin Guide (CoPhish, XPIA, Connected Agents, CVE-2024-38206, audit gaps)
Cloud Security Alliance — MAESTRO: a threat-modeling framework for agentic AI