AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Copilot & Agentforce offen für Prompt-Injection-Tricks

highnewsLLM-Specific

security

Source: CSO OnlineApril 20, 2026

Summary

Researchers at Capsule Security discovered prompt injection vulnerabilities (attacks where malicious instructions are hidden in normal-looking inputs) in both Microsoft Copilot Studio and Salesforce Agentforce that allow attackers to trick AI agents into stealing data. In Microsoft's case, attackers can inject malicious commands into SharePoint forms to extract sensitive customer data and send it via email, while in Salesforce's case, they can embed harmful instructions in public lead forms to exfiltrate CRM data at scale.

Solution / Mitigation

For Microsoft Copilot Studio: "Microsoft has meanwhile published a patch that has fixed the problem" and "no further measures are required on the part of users." For Salesforce Agentforce: The source text does not describe an explicit patch or mitigation from Salesforce. The source states that "Salesforce acknowledged the prompt injection problem" but classified the data exfiltration issue as "configuration-specific" and pointed to "optional human-in-the-loop controls." General recommendations mentioned include: "input validation, least-privilege access, as well as strict control" and treating "all external inputs as untrusted" while setting up "filters that separate data from instructions."