🚨 Security Alert for Microsoft Copilot Studio Users

A new research drop reveals a serious risk in Copilot Studio’s Connected Agents feature — it can be abused as a silent AI backdoor.

Here’s the scary part 👇 Connected Agents are enabled by default, and a malicious agent can piggyback on a trusted one to:

• Send spoofed emails from official company mailboxes

• Trigger sensitive tools (CRM, email, workflows)

• Stay invisible in normal audit logs

Researchers showed how attackers can chain agents together and quietly run actions without defenders noticing — perfect for phishing, fraud, or misinformation campaigns.

🔗 Full research by Zenity Labs

https://fizoval.com/blog/microsoft-copilot-studio-connected-agents-security-risk