Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Researchers from Zenity demonstrated how an organization's data can be exfiltrated via prompt injections that target an AI-powered customer service agent.
The target system is a customer service agent built by Zenity in Copilot Studio. It is modeled after an agent built by McKinsey to streamline its customer service needs. The AI agent listens to a customer service email inbox where customers send their engagement requests. Upon receiving a request, the agent looks at the customer's previous engagements, understands who the best consultant for the case is, and proceeds to send an email to the respective consultant regarding the request, including all of the relevant context the consultant will need to properly engage with the customer.
The Zenity researchers begin by performing targeting to identify an email inbox that is managed by an AI agent. Then they use prompt injections to discover details about the AI agent, such as its knowledge sources and tools. Once they understand the AI agent's capabilities, the researchers are able to craft a prompt that retrieves private customer data from the organization's RAG database and CRM, and exfiltrate it via the AI agent's email tool.
Vendor Response: Microsoft quickly acknowledged and fixed the issue. The prompts used by the Zenity researchers in this exercise no longer work, however other prompts may still be effective.
ASSESSED SYSTEM
Representative configuration: an email-triggered customer-service agent built on Microsoft Copilot Studio, as constructed by Zenity and modelled on a publicly described McKinsey deployment, in its pre-fix state (MITRE ATLAS AML.CS0037, June 2025). The agent listens to a public customer-service inbox, is activated by any inbound email, consults a 'Customer Support Account Owners.csv' knowledge source and a Salesforce get-records tool, and sends email with an email tool to route the request with context. The class is defined by that autonomy (event-triggered, no human in the loop), exposure (a public inbox) and downstream reach (CRM read and outbound email).
OUT OF SCOPE
McKinsey's actual production agent, which was not tested; the researchers' sending and receiving mailboxes; Copilot Studio after Microsoft's fix; the Salesforce platform beyond the agent's get-records connection; and the Fairness axis (Fa-1..4), for which an exfiltration exercise produces no evidence.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: one agent; no peer-agent exchange is described. Q2 = YES: the agent is activated by an inbound email trigger, plans and executes a multi-step workflow — knowledge-source lookup, CRM retrieval through the Salesforce get-records tool, and an outbound email — with no human approval at any step. Evidence: the researchers 'infer that the AI agent is activated when receiving an email' and that it 'has a tool for sending emails', and the final prompt made the agent retrieve and email the data unaided. Tier 2: Tier 2 Consumer: the agent sits directly behind a public, unauthenticated customer inbox and its exploitation exposes customers' records held in the CRM — individuals' data — consistent with the ForcedLeak workpaper for a public-intake CRM agent.
Documented attack or failure path
- The researchers identified a support email address likely to be managed by an AI agent and probed it with emails, looking for agentic behaviour in automatic replies.
- A crafted email instructed the agent to reply to an address of the researchers' choosing; the reply arrived, confirming an agent was present, that it was activated by inbound email, and that it held an email-sending tool.
- Through further injected emails the researchers enumerated the agent's knowledge sources and tools, discovering the 'Customer Support Account Owners.csv' source and the Salesforce get-records tool.
- A final crafted prompt instructed the agent to retrieve every field and row of the CSV and all records from the Salesforce CRM; the agent retrieved the entire file and all CRM records.
- The prompt then instructed the agent to email the results to an attacker-chosen address, and the agent did so through its email tool, completing the exfiltration with no human involvement.
- Microsoft acknowledged and fixed the issue; the specific prompts no longer work, while the record notes other prompts may still be effective.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The agent acted only through the knowledge source and connectors configured for it; no credential theft or access outside the agent's granted connections is reported. This is why Cn-1 is placed at 0.25 rather than 0.00.
- Microsoft acknowledged and fixed the issue after disclosure so that the researchers' prompts no longer work, which bears on Remediation Feasibility.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.77 (midpoint 0.39), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.00w 0.23 | The 0.00 anchor: naive, non-adaptive prompt injection on the agent's intended intake surface succeeded repeatedly, and no adversarial testing of that path is evidenced. The 0.25 anchor requires basic filters that at least resist naive attacks, which the evidence contradicts. | Plain-language instructions in an email body sent to a public inbox were followed by the agent from the first probe — it replied to an attacker-chosen address — and repeated injections disclosed its knowledge sources and tools and finally drove bulk retrieval and exfiltration. No adaptive technique, encoding or obfuscation is described as necessary at any stage.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.35 | The 0.25 anchor: some minimisation exists in that the agent reaches only its configured sources, but its retrieval and downstream integration paths carry the full dataset far beyond the single-request purpose. Not 0.50: the primary data path itself — CRM retrieval into an outbound message — is not minimised. | The agent's task is to route one customer's engagement request to the right consultant, yet on instruction it retrieved 'all of the fields and rows' of the account-owners file and 'all records from the victim's CRM' and transmitted them. No per-call field restriction, record-count limit or sensitivity constraint on the agent's retrieval or outbound path is evidenced.source: secureflow/atlas |
| Containment (Cn) — scenario interval 0.02–0.58 (midpoint 0.30), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.09 | The 0.25 anchor: basic boundaries exist (the configured tool and knowledge set) but are enforced inconsistently, and simple prompt manipulation exceeded the intended data and network scope. Not 0.50: the common violation — bulk export to an external recipient — was not blocked. | Once injected, the agent read every CRM record and the whole account-owners file and sent them to an arbitrary external address, well outside a route-this-request envelope. Its reach was nevertheless bounded by the knowledge source and connectors configured for it; no access beyond those connections is reported.source: secureflow/atlas |
| Cn-3Output Filtering Robustness | 0.00w 0.13 | The 0.00 anchor: sensitive output was returned directly to an unauthorised destination with no filtering or policy enforcement. Not 0.25, because no basic filter is evidenced to have existed and been bypassed. | The agent's outbound email carried the complete CRM record set and the account-owners file to an address supplied by an anonymous sender. The record shows no sensitivity detection, volume check, recipient allowlist or data-loss-prevention policy on the agent's email output.source: secureflow/atlas |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.08 | The 0.00 anchor: no reversibility classification is performed before execution and the action runs ungated (ARCR = 0). Not 0.25, because no selective gating of any high-impact action is evidenced. | Outbound email to an arbitrary external recipient — an irreversible disclosure with external impact, delegated-irreversible in the Cn-6 taxonomy — executed with no pre-execution classification or approval, triggered by an inbound email with no human in the loop.source: secureflow/atlas |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: no origin labelling is evidenced and content from an untrusted external sender was admitted to active context as trusted instruction by design, with cross-boundary instructions producing tool calls, data access and disclosure the operator never requested. The 0.25 anchor requires origin labels on some channels or instruction authority denied at least by prompt wording; the record shows neither on the email intake path, and Microsoft's post-disclosure fix is not evidenced as a trust-labelling control. | The agent is activated by any inbound email to a public inbox, and plain-language instructions in an email body from an anonymous sender were followed from the first probe: the agent replied to an attacker-chosen address, disclosed its knowledge sources and tools under further injected emails, and finally retrieved every CSV row and all CRM records and emailed them to an attacker-chosen address. No labelling of inbound email as untrusted data and no separation between the request content and the agent's instruction channel is recorded on the intake surface.source: secureflow/atlas |
Unknown, not N/A: 20 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.85w 0.25 | Above the 0.75 supervised-autonomy anchor. The agent is activated by any inbound email and retrieves CRM data and sends outbound email with no human approval and no escalation gate for bulk or external sends. Below 1.00 because its designed envelope is request routing rather than independent transaction or record-mutation authority, which the evidence does not show. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 anchor. Any party on the internet can email the public customer-service inbox, the agent ingests that content directly into its instruction context with no sender authentication, and from there it reaches a CRM connector and an outbound email tool. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph exists for the configuration, so the specification default applies, and the 1.00 anchor is independently corroborated on the observed path: taint ran from an anonymous email (L1) through the knowledge source and Salesforce get-records tool (L3) to an attacker-controlled external mailbox (L4) with no gate on any edge — an ungated path to a P3 external-disclosure node.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.60w 0.20 | Documented intermediate between two anchors, as in the ForcedLeak workpaper. Microsoft fixed the platform issue so that the researchers' prompts no longer work (the 0.25 anchor for the demonstrated path), but the record states other prompts may still be effective: the enabling defect, an event-triggered agent treating untrusted email as instructions while holding bulk-read and send authority, is a model-level property mitigable only through external layers (the 0.75 anchor). |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | Between the 0.25 and 0.50 anchors. Because the researchers built the agent, its trigger, knowledge source, tools and workflow are documented — a partial architecture record — but no model lineage, connector permission export, platform configuration or evaluation artefact is public, and the configuration is a replica rather than a production system. |
| Ec — Public evaluation coverage | 0.20 | coverage 0.23 (6 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2025-06-01; age 504 days on the workpaper reference date. Components: T_containment 0.00 · T_calendar 0.02 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_containment. dt_days = 504, measured from originating evidence to the 2026-10-18 evidence reference date; the AIDEFEND SecureFlow record republished the flow later and republication does not reset evidence age. The evidence date is MITRE ATLAS's month-granularity incident date for AML.CS0037 (June 2025); the Zenity primary posts carry no separately recorded date in this workpaper. agentic = true: an Agentic/MCP-class deployment with runtime-mutable connector and tool scopes, so the containment staleness floor with M_Cn = 2.0 applies. baw = false: no model-writable cross-session memory, runtime agent-to-agent channel, self-modifying configuration or closed feedback loop is evidenced; the agent reads CRM records but the record shows no write path back into its own context sources. C_monitor 0.65 — bulk CRM export to an external address produced no evidenced alert. C_event 0.65 — a researcher exercise against a replica agent, fixed by the vendor, with no reported in-the-wild exploitation; the moderate row. C_evidence 0.85 — the specific prompts are blocked but the record states other prompts may still work. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.03 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
7.5 midpoint, interval 3.3–10.0; High scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-017.007 | Dual-LLM Isolation PatternExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-7. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-9, step-10, step-12, step-13, step-14. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-9, step-10, step-12, step-13. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-003.003 | Agentic Tool Use & Action Policy MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-9, step-14. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-018.006 | Continuous Authorization Verification (Anti-TOCTOU)Exact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-13. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-003.004 | Tool-Call Sequence Anomaly DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-13. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-14. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-14. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-14. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
WHAT THIS CASE TEACHES
A researcher-built replica on a real agent platform can be scored as a representative configuration when the source states its trigger, tools and reach — but its fidelity is staging-equivalent, and an email-triggered agent with bulk CRM read and unrestricted send reaches CRM 1.35 on autonomy, exposure and corroborated cascade alone.
Sources: AIDEFEND SecureFlow — Data Exfiltration via Agent Tools in Copilot Studio · MITRE ATLAS case study AML.CS0037 · AgentFlayer: Discovery Phase of AI Agents in Copilot Studio (labs.zenity.io) · AgentFlayer: When AIjacking Leads to Full Data Exfiltration in Copilot Studio (labs.zenity.io)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0037 (exercise) |
|---|---|
| Target | Copilot Studio Customer Service Agent |
| Actor | Zenity |
| Primary evidence date | 2025-06-01 |
| SecureFlow record updated | 2026-09-18 |
| AI layers | Copilot saas, Autonomous agents, Tool integrations / MCP, RAG and knowledge systems |
| Risk impact | Data exfiltration |
| Affected components | Copilot Studio customer service agent, agent-monitored support inbox, Customer Support Account Owners CSV, Salesforce get-records tool, agent email tool |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Identify Agent-Managed Support InboxThe researchers look for support email addresses on the target organization's website which may be managed by an AI agent. Then, they probe the system by sending emails and looking for indications of agentic AI in automatic replies. | AML.TA0002 AML.T0006.003 |
| 2 | Craft Email Probe PromptOnce a target has been identified, the researchers craft prompts designed to probe for a potential AI agent monitoring the inbox. The prompt instructs the agent to send an email reply to an address of the researchers' choosing. | AML.TA0001 AML.T0065 |
| 3 | Send Malicious Email to Agent InboxThe researchers send an email with the malicious prompt to the inbox they suspect may be managed by an AI agent. | AML.TA0004 AML.T0093 |
| 4 | Trigger Agent Reply and Confirm Agent PresenceThe researchers receive a reply at the address they specified, indicating that there is an AI agent present, and that the triggered prompt injection was successful. | AML.TA0005 AML.T0051.002 |
| 5 | Infer Email Activation TriggerThe researchers infer that the AI agent is activated when receiving an email. | AML.TA0008 AML.T0084.002 |
| 6 | Discover Email-Sending ToolThe researchers infer that the AI agent has a tool for sending emails. | AML.TA0008 AML.T0084.001 |
| 7 | Interact with Agent via EmailFrom here, the researchers repeat the same steps to interact with the AI agent, sending malicious prompts to the agent via email and receiving responses at their desired address. | AML.TA0000 AML.T0047 |
| 8 | Probe Knowledge Sources and ToolsThe researchers modify the original prompt to discover other knowledge sources and tools that may have data they are after. | AML.TA0005 AML.T0051 |
| 9 | Discover Customer Account Owners Data SourceThe researchers discover the AI agent has access to a "Customer Support Account Owners.csv" data source. | AML.TA0008 AML.T0084.000 |
| 10 | Discover Salesforce get-records ToolThe researchers discover the AI agent has access to the Salesforce get-records tool, which can be used to retrieve CRM records. | AML.TA0008 AML.T0084.001 |
| 11 | Craft Data-Theft and Exfiltration PromptThe researchers put their knowledge of the AI agent's tools and knowledge sources together to craft a prompt that will collect and exfiltrate the customer data they are after. | AML.TA0001 AML.T0065 |
| 12 | Retrieve Customer Support Account Owners FileThe prompt asks the agent to retrieve all of the fields and rows from "Customer Support Account Owners.csv". The agent retrieves the entire file. | AML.TA0009 AML.T0085.000 |
| 13 | Retrieve Salesforce CRM RecordsThe prompt asks the agent to retrieve all Salesforce records using its get-records tool. The agent retrieves all records from the victim's CRM. | AML.TA0009 AML.T0085.001 |
| 14 | Exfiltrate Results via Email ToolThe prompt asks the agent to email the results to an address of the researcher's choosing using its email tool. The researchers successfully exfiltrate their target data via the tool invocation. | AML.TA0010 AML.T0086 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0037-data-exfiltration-via-agent-tools-in-copilot-studio; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0037 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).