MindPattern
← The Wire

Security2026-06-19 · source-backed

Microsoft patched a Copilot Studio injection and data still leaked.

Confidence
source-backed
Sources
1
Redaction
passed

Story

VentureBeat documented a Copilot Studio prompt-injection flaw where the applied patch did not stop data exfiltration. That's the lesson worth internalizing: fixing the injection vector is not the same as preventing the downstream leak the agent can still perform with its permitted actions. The case is being used as a template for agent remediation playbooks across Microsoft and Salesforce Agentforce. If your remediation stops at "we closed the injection path," you've fixed the door and left the windows open.

Related stories

Each link below shares sources, entities, or timing with this story.

  1. Shared entities / Same source domain / Shared topic / What happened next

    Microsoft Takes Agent 365 Live to Govern Shadow AI

    Both cover Microsoft, VentureBeat; reported by the same outlet (venturebeat.com); overlapping topics (agent, copilot, microsoft).

  2. Shared entities / Shared topic / Earlier coverage / Tension

    Azure DevOps Remote MCP Server: Zero-Install Hosted MCP.

    Both cover Copilot Studio, Microsoft; overlapping topics (agent, copilot, microsoft); earlier Copilot Studio coverage from 2026-03-18.

  3. Shared entity: VentureBeat / Same source domain / Shared topic

    Three AI coding agents leaked secrets through one prompt injection payload.

    Both cover VentureBeat; reported by the same outlet (venturebeat.com); overlapping topics (action, agent, case, copilot, injection).

  4. Shared entity: Microsoft / Shared topic / Earlier coverage

    CVE-2026-26144: Excel Copilot Agent Mode Enables Zero-Click Data Exfiltration.

    Both cover Microsoft; overlapping topics (action, agent, copilot, data, microsoft); earlier Microsoft coverage from 2026-03-19.

  5. Microsoft Copilot Studio Agent Security Top 10

    Both cover Microsoft; overlapping topics (agent, copilot, data, injection, microsoft); earlier Microsoft coverage from 2026-02-16.

  6. The "AI control plane" land grab: Snowflake, Salesforce, and Microsoft race to own where agents run.

    Both cover Microsoft; overlapping topics (agent, agentforce, data, microsoft); earlier Microsoft coverage from 2026-06-14.

  7. Nadella Admits Office Is the CRUD That Agents Will Eat

    Both cover Microsoft; overlapping topics (agent, copilot, data, microsoft); earlier Microsoft coverage from 2026-03-01.

  8. Shared entity: Microsoft / Same source domain / Shared topic / Earlier coverage

    Agent Skills Open Standard Reaches Critical Mass

    Both cover Microsoft; reported by the same outlet (venturebeat.com); overlapping topics (agent, copilot).

Source trail

Copilot Studio prompt-injection flaw where the applied patch did not stop data exfiltration

Entities

Copilot StudioMicrosoftSalesforce AgentforceVentureBeat

Provenance

Canonical issue
Ramsay Research Agent — June 19, 2026
AI generated
no
Story unit
2026-06-19-microsoft-patched-a-copilot-studio-injection-and-data-still-leaked
Labels
source-backed, canonical briefing excerpt