Case copilot-agentforce-injectionPrompt injectionWorldwide
Prompt injection leaks data from Microsoft Copilot Studio and Salesforce Agentforce agents
Researchers demonstrated indirect prompt injection that exfiltrated data from enterprise agents built on Copilot Studio (CVE-2026-21520) and Agentforce despite earlier patches.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 15, 2026
- Location
- Worldwide
- Target
- Copilot Studio, Salesforce Agentforce
- Severity
- High
- Triggered by
- Security researchers at Capsule Security (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2026-21520
What happened
Researchers demonstrated indirect prompt injection that exfiltrated data from enterprise agents built on Copilot Studio (CVE-2026-21520) and Agentforce despite earlier patches.
Impact: Demonstrated exfiltration of SharePoint list data by email and misuse of Agentforce workflows; Microsoft safety filters flagged but did not stop the payload; no confirmed real-world victims
Who triggered it
Actor: Security researchers at Capsule Security (responsible disclosure)
Attribution: Self-attributed research by Capsule Security; Microsoft assigned CVE-2026-21520 (ShareLeak); Salesforce confirmed addressing PipeLeak
Motive: Security research and responsible disclosure
How it happened
Attack vector: Indirect prompt injection via ordinary business inputs: a SharePoint form comment field (Copilot Studio) and a public lead form (Agentforce) carrying fake system instructions
Root cause: Untrusted form input was concatenated into agent system prompts with no separation between trusted instructions and user data, so agents followed injected commands through authorized tools
Timeline
- Microsoft patches the Copilot Studio flaw server-side
- CVE-2026-21520 published (CVSS 7.5)
- Capsule Security publicly discloses ShareLeak and PipeLeak alongside its launch
Response
Microsoft mitigated internally with no customer action required; Salesforce said it addressed the issue; researchers warned the attack class remains open
Current status: Patched
Sources (open in a new tab)
- OECD AI Incidents Monitor oecd.ai
- CSO Online csoonline.com
- SiliconANGLE siliconangle.com
Cite this case
Prompt injection leaks data from Microsoft Copilot Studio and Salesforce Agentforce agents. AI Threat Watch, case copilot-agentforce-injection, Apr 15, 2026. https://aithreat.io/cases/copilot-agentforce-injection/
Permanent link: https://aithreat.io/cases/copilot-agentforce-injection/