← Catalog
Research high discovered 2025-06-01

Data Exfiltration via Agent Tools in Microsoft Copilot Studio

Researchers showed that a Copilot Studio customer-service agent could be enumerated, fingerprinted, and then driven by prompt injection to collect and exfiltrate an organization's data through its own connected tools.

Reconnaissance Initial Access Persistence Discovery Execution Collection Exfiltration

What happened

Researchers from Zenity demonstrated (catalogued by MITRE ATLAS as AML.CS0037) how an organization’s data can be exfiltrated from an AI-powered customer-service agent built in Microsoft Copilot Studio. The attack begins with reconnaissance and discovery — probing the public-facing agent to learn its configuration and which tools/connectors it can call — then uses prompt injection to make the agent collect internal records and send them out through those same tools.

It is a clean end-to-end demonstration of the agentic kill chain: find the agent, fingerprint what it can do, hijack it with injected instructions, collect data via its connectors, and exfiltrate.

Why it maps to ATLAS

  • AML.T0006 — Active Scanning (Reconnaissance): the public agent is probed to map its behavior.
  • AML.T0093 — Prompt Infiltration via Public-Facing Application: the injection enters through the agent’s public interface.
  • AML.T0084 — Discover AI Agent Configuration (Discovery): the attacker learns the agent’s tools and setup.
  • AML.T0051.002 — LLM Prompt Injection: Triggered: a condition triggers the planted instructions.
  • AML.T0085.001 — Data from AI Services: AI Agent Tools (Collection): data is gathered via the agent’s tools.
  • AML.T0086 — Exfiltration via AI Agent Tool Invocation: the agent’s own actions carry data out.

Detection notes

Agents that are publicly reachable get enumerated first — treat discovery-style probing as an early warning. Scope connectors tightly, log tool invocations against the originating task, and alert when an agent reads records or reaches endpoints outside its normal workflow.

Detection

Log sources

  • Agent enumeration / discovery request logs
  • Tool-invocation + connector access traces
  • Outbound egress from the agent runtime

Signals

  • Systematic probing that reveals an agent's configuration and available tools
  • Injected instructions triggering tool calls outside the task scope
  • Agent reading and shipping records via connectors to external destinations

Mitigations

  • Restrict agent tool/connector scope to least privilege
  • Sanitize untrusted input before it reaches agent context
  • Monitor and rate-limit agent enumeration; alert on unexpected egress