Microsoft Copilot Studio's Hidden Security Risks Exposed

Microsoft's Copilot Studio is making it easier for organizations to build AI agents that automate business processes, interact with enterprise data, and connect to downstream applications. However, as AI agents become trusted enterprise identities, security teams need to understand the infrastructure they run on and the assumptions those platforms make about isolation, privilege, and trust.

A recent investigation by BeyondTrust Phantom Labs Staff Security Researcher Simon Maxwell-Stewart into the infrastructure underlying Microsoft Copilot Studio found several security vulnerabilities. The research began with a legitimate Dataverse feature that allows custom .NET assembly plugins. The team used these to gain admin and system-level access to the sandboxed plugin containers running that code, enabling them to exfiltrate DLLs and reverse-engineer an architecture that had not previously been documented by the security research community.

The audit found that Microsoft's stated security boundaries did not hold in practice: plugins had broad network access and could touch the local file system despite documentation claiming otherwise. The team also identified a plausible attack path in which a malicious plugin installed via Microsoft's AppSource marketplace could run alongside other tenants' plugins on a shared container and intercept private data in a man-in-the-middle fashion.