Agent Vulnerabilities: The New Frontier

Vulnerabilities in AI agent platforms, including Microsoft Copilot Studio and Salesforce Agentforce, expose a new class of security risks. Capsule Security disclosed ShareLeak, an indirect prompt injection flaw in Copilot Studio, on Wednesday, following its discovery on November 24, 2025. Microsoft patched this vulnerability, assigned CVE-2026-21520, and deployed a fix by January 15, 2026.

ShareLeak exploits the integration between SharePoint form submissions and Copilot Studio's context window. Attackers inject malicious payloads into comment fields, overriding agent instructions to query and exfiltrate customer data via Outlook. Despite Microsoft's safety mechanisms flagging the activity, data was exfiltrated as the system perceived the Outlook action as authorized. Carter Rees noted this as an architectural failure where the LLM struggles to distinguish trusted instructions from untrusted data.

Capsule Security also identified PipeLeak, a similar indirect prompt injection vulnerability affecting Salesforce Agentforce. While Microsoft assigned a CVE for its agent flaw, Salesforce had not issued a public advisory or CVE for PipeLeak as of publication. This vulnerability class, characterized by the 'lethal trifecta' of private data access, untrusted content exposure, and external communication ability, poses a significant challenge.

Experts emphasize that traditional security measures like static firewalls and deterministic rules are insufficient for agentic systems. The focus is shifting towards runtime security and monitoring actual agent actions rather than just perceived intent. Organizations are urged to treat prompt injection as a class-level risk and incorporate runtime enforcement into their security planning for 2026.