Cases › security breach › LR-2026-0344
Researchers hack Copilot AI agent, exposing fraud risks
Preliminary Why: 1 report: SecurityBrief Australia · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, could do, deployer.
Tenable researchers built a demonstration travel agent in Microsoft Copilot Studio to handle customer travel reservations, able to create and modify bookings without human intervention. The agent was loaded with demonstration customer records, including names, contact details and credit card information, and was configured to verify identity before sharing data or changing bookings. Researchers then used a prompt injection technique to hijack its workflow. They booked a free holiday and extracted payment card data, and changed a trip price to zero, which the researchers said granted services without authorisation. The agent's broad edit permissions covered the financial fields in booking records. Tenable disclosed the research, which was reported on 2025-12-12, and recommended limiting agent write rights and monitoring agent behaviour.
What happened
What was done
No source states an action or fix.
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Also63 incidents
Rising: 5 vs 2.2 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessOutside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list
ApplicationHuman approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use
Evidence
- What set it off hidden instructions in its input
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show the full account: 7 items from the primary sources
What happened, in order
Not dated in the sources:
- Researchers built a demonstration AI travel agent within Copilot Studio.
- Researchers loaded the system with demonstration customer records.
- Tenable then attempted to subvert the agent using a prompt injection technique.
- The researchers hijacked the agent's workflow.
- The researchers instructed the agent to change the trip price to zero.
- The agent carried out the price change.
- Tenable disclosed the research.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
No count of affected parties or records, and no monetary loss, is stated. The identity-check bypass is reported but no matching control id was assigned. Remediation items are recommendations, not changes made by a party, so kind is advice.
LR-2026-0344 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON