Microsoft Copilot Agent Security Flaw Exposes Sensitive AI Operations

Microsoft has disclosed a critical flaw in its Copilot agents’ governance framework, allowing any authenticated user to access and interact with AI agents within an organization—bypassing policy controls and exposing sensitive operations to unauthorized actors.

The Flaw Explained

• Policy Enforcement Failure: Copilot Agent Policies are not enforced when users enumerate and invoke AI agents via Graph API endpoints.
• Admin Center vs. Graph API: While the Microsoft 365 admin center correctly hides restricted agents, the Graph API exposes all agents, including those marked "private" or limited to privileged roles.
• Exploit Details: Unauthorized users can retrieve agent identifiers, metadata, and endpoints with a simple GET request to https://graph.microsoft.com/beta/ai/agents/ and invoke agents without policy checks.

Impact and Risks

• Zero-Trust Compromised: The flaw undermines Microsoft’s zero-trust posture, exposing sensitive workflows like privileged credential rotation and executive briefing generation to all users.
• Severity: Tracked as CVE-2025-XXXX, the flaw carries a CVSS 3.1 score of 9.1 (Critical).

Microsoft’s Response

• Swift Remediation: Microsoft patched the policy enforcement middleware in August 2025 and notified customers via the Microsoft 365 Message Center.
• Engineer’s Admission: A Microsoft engineer confirmed the oversight, stating, "We thought tenant administrators had exclusive visibility into their AI agents, but the enforcement plane in Graph was wide open."

Recommendations for Organizations

1. Audit Graph API Permissions: Restrict unnecessary access to AI-related endpoints.
2. Implement Conditional Access: Require multi-factor authentication and device compliance for Graph API usage.
3. Monitor Agent Activity: Set up SIEM alerts for unusual agent calls or off-hours access.
4. Review Agent Catalog: Delete unused agents to reduce the attack surface.

Broader Implications