GCD AI RADAR
incidents/AIR-2025-0059

Data Exfiltration via Prompt Injections in Copilot Studio Agent

Attack on AI1 Research / proof of conceptPrompt injectionAgent hijackData leak

Researchers demonstrated how an organization's data could be exfiltrated through prompt injections targeting an AI customer service agent. The attack exploited tool access in a Copilot Studio implementation.

Details

type
Attack on AI
An AI model, agent or AI-powered product was the thing exploited, abused or leaked.
categories
  • Prompt injectionprimary
    Untrusted content (web pages, documents, emails, tool output) steers a model into ignoring its instructions.
  • Agent hijack
    An AI agent is tricked into unauthorized actions: tool misuse, data exfiltration through the agent, or acting against its principal.
  • Data leak
    Training data, chat logs, system prompts, model weights or other AI-system data exposed.
owasp llm top 10
mitre atlas
Both rows are derived from the type and categories (OWASP 2025 edition, ATLAS release 2026.09), not classified per record. How
severity
1 · Research / proof of concept
Demonstrated by researchers; no known real-world exploitation.
targets
Microsoft, Enterprise deployment
products
Copilot Studio
incident date
Jun 2025 (approx.)
first reported
7 Nov 2025
origin
MITRE ATLAS
Derived from MITRE ATLAS (Apache 2.0, © MITRE).
classifier confidence
0.95 · published at or above 0.80; see the methodology
tags
prompt-injection · copilot-studio · data-exfiltration · agent-hijack
record
created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z · json

Sources · 3

  1. 2025-11-07
    Data Exfiltration via Agent Tools in Copilot Studio
    MITRE ATLAS · atlas.mitre.org/studies/AML.CS0037
  2. 2025-11-07
    AgentFlayer: Discovery Phase of AI Agents in Copilot Studio
    Zenity Labs · labs.zenity.io/p/a-copilot-studio-story-discovery-phase-in-ai-agents-f917
  3. 2025-11-07
    AgentFlayer: When AIjacking Leads to Full Data Exfiltration in Copilot Studio
    Zenity Labs · labs.zenity.io/p/a-copilot-studio-story-2-when-aijacking-leads-to-full-data-exfi

Titles and links belong to their publishers. The summary above is written by GCD AI RADAR in its own words; data is CC BY-SA 4.0.

Related incidents