Security researchers demonstrated a "0-click" exploit against Microsoft Copilot Studio — an enterprise AI agent-building platform. The attack required no interaction from the victim beyond having the agent active.

How it worked: The attack exploited the fact that Copilot Studio agents had access to overly broad tool permissions by default. The agent could access and forward documents, emails, and files it was never intended to exfiltrate. A specially crafted input caused the agent to invoke these tools in a sequence that exfiltrated sensitive user data to the attacker.

No vulnerability in the tools themselves. No privilege escalation. The tools were doing exactly what they were designed to do — just being called in a sequence and for a purpose that wasn't intended.

Amazon Q Developer, an AI coding assistant, was demonstrated to be vulnerable to prompt injection attacks that caused it to use its network access tools to exfiltrate secrets. The agent had access to networking tools (legitimate — it needs them for code-related tasks) and those tools were used to encode and transmit secrets via DNS queries to attacker-controlled infrastructure.

The tool worked correctly. DNS resolution is a normal, authorized action. The misuse was in what was being resolved — a hostname encoding the secret as data.