Reviewing Microsoft Copilot Studio agents — three 2026 CVEs and the DLP gap they share

Copilot Studio agents inherit two things by default: broad connector access to Microsoft 365 data, and Microsoft's own Data Loss Prevention (DLP) policy engine sitting in front of that access. DLP is a real control — it's also, as the incidents below show, a control that evaluates actions as legitimate-or-not, not intent as benign-or-malicious. That distinction matters more than it sounds like it should.

None of the three required compromising an account or bypassing authentication. Each found a place where the platform trusted a request — a search-grounded citation, a rendered document, an agent-initiated action — without re-verifying it against the actual requesting user's permission at the moment it mattered.

CVE-2026-21520 has a name — “ShareLeak” — and a fully documented exploit chain from Capsule Security, disclosed November 24, 2025, confirmed by Microsoft December 5, patched January 15, 2026, and publicly detailed April 16, 2026. The attack: fill a public-facing SharePoint form field — an ordinary comment box — with a fake system-role message. When Copilot Studio concatenates that field unsanitized into the agent's prompt, it hijacks a SharePoint-form-triggered agent into querying SharePoint data and exfiltrating it via an authorized Outlook send action the agent was already permitted to perform.

A fourth Copilot Studio CVE, disclosed even more recently than the three already covered, is CVE-2026-80098 — CVSS 9.3, elevation of privilege via improper verification of a cryptographic signature, reachable over the network with no privileges or user interaction required. It was reserved August 25, 2026 and published September 3, 2026 — recent enough that detailed public exploit mechanics were not yet available at the time of this writing. A review should treat it as an open item to track, not assume it's fully understood yet.

The sharpest lesson across public research on Copilot Studio incidents isn't any single CVE — it's that DLP policies built to catch unauthorized actions don't catch a legitimate action used for an unauthorized purpose. An agent that's permitted to send an Outlook email is permitted to send an Outlook email; DLP has no reason to block it just because a prompt injection is what decided the email's recipient or content. The exfiltration path runs entirely through functionality the agent was supposed to have.

That reframes the review question. It isn't “does this agent have a dangerous permission” — it's “can content this agent processes, that the agent doesn't control, influence which of its permitted actions it takes and against whom.” A DLP policy that's well-configured for the first question can still fail the second.

For any team building or enabling Copilot Studio agents, a design-time review should be able to answer:

• Are Copilot Studio and the connected Microsoft 365 Copilot components patched past the versions addressed by CVE-2026-21520, CVE-2026-42824, and CVE-2026-26144?
• Does DLP policy account for a legitimate action taken as a result of untrusted content the agent processed, not just the action's inherent permission level?
• Is agent action authority re-verified against the actual requesting user's permissions at execution time, or inherited from the agent's own service identity?
• Are connectors (email, SharePoint, Dataverse) scoped per-agent to what each specific agent's task requires, rather than granted broadly by default?
• Is the tenant patched against CVE-2026-80098, and is that patch status actively tracked given how recently it was disclosed?
• Do public-facing forms (SharePoint, Web-to-Lead, or equivalent) that feed agent-visible fields have input scanning or length limits, given the ShareLeak/PipeLeak precedent applies to any vendor's forms?

See tool-use permission scoping for the framework-agnostic version of the connector-scoping question above.