Indirect prompt injection in Microsoft Copilot Studio enabled unauthenticated data exfiltration
CVE-2026-21520, dubbed ShareLeak, is an indirect prompt injection vulnerability in Microsoft Copilot Studio that allowed unauthenticated attackers to hijack agents via crafted SharePoint form submissions and exfiltrate sensitive data through Outlook. Microsoft patched the flaw in January 2026, but Capsule Security confirmed data was still exfiltrated after the patch because safety mechanisms flagged the suspicious request yet failed to block it. The CVSS 7.5 vulnerability exposed a structural weakness in agentic AI systems that cannot be fully remediated by patching alone.
The LLM could not distinguish trusted system instructions from untrusted injected content, so it faithfully exfiltrated data through a legitimate Outlook action that bypassed DLP entirely.
Key facts
- What
- CVE-2026-21520, dubbed ShareLeak, is an indirect prompt injection vulnerability in Microsoft Copilot Studio that allowed unauthenticated attackers to hijack agents via crafted SharePoint form submissions and exfiltrate sensitive data through Outlook.
- Incident date
- Jan 22, 2026
- Who
- Microsoft
- Failure mode
- Prompt Injection
- AI surface
- Agentic Workflow
- Severity
- High
What happened
Capsule Security discovered that an unauthenticated attacker could submit a crafted payload through a public-facing SharePoint form field, which Copilot Studio concatenated directly into the agent context window without sanitization. The injected payload hijacked the agent goals, causing it to query connected SharePoint Lists and send the results via Outlook to an attacker-controlled email address. Microsoft patched the specific ShareLeak vector as CVE-2026-21520 in January 2026, but Capsule Security's post-patch testing confirmed that Microsoft's safety mechanisms flagged the suspicious request while the data was still exfiltrated. The DLP system never triggered because the email was routed through a legitimate Outlook action treated as an authorized operation.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
Copilot Studio lacked input sanitization between the public SharePoint form and the agent context window, allowing untrusted content to override trusted system instructions. The LLM served as a confused deputy that could not distinguish its original directives from the attacker's injected commands. Microsoft's safety stack flagged the malicious outbound request but had no enforcement mechanism to block it, and DLP failed because the exfiltration channel was a native Outlook action indistinguishable from legitimate use.
What it cost
Sources
- PrimaryCVE-2026-21520 Detailnvd.nist.gov
- PressMicrosoft patched a Copilot Studio prompt injection. The data exfiltrated anywayventurebeat.com
- PressGoogle Patches AntiGravity IDE Flawthehackernews.com
Cite this entry
https://failureindex.ai/failures/indirect-prompt-injection-microsoft-copilotAI Failure Index. "Indirect prompt injection in Microsoft Copilot Studio enabled unauthenticated data exfiltration" (FI-0171). Realm Labs. https://failureindex.ai/failures/indirect-prompt-injection-microsoft-copilot (indexed Jun 4, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0171. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.