Microsoft warns enterprise AI agents can be hijacked via prompt injection; expands Project Perception containment controls
Microsoft has warned that AI agents with access to enterprise systems can be manipulated through prompt injection, compromised inputs or shifts in task context. Agents do not need malicious intent to cause harm: their ability to read corporate data, invoke tools, approve transactions and talk to other agents widens exposure once untrusted content influences their decisions. Microsoft is extending Project Perception with controls to identify agents, limit their authority and contain unsafe behavior without relying on models to police themselves. The article describes a vendor security roadmap and warning, not an observed in-the-wild campaign.
Detalhes técnicos
- Microsoft's example is an expense-approval agent that reads an external document containing an injected prompt. Its configuration stays unchanged, but its behavior shifts to actions outside its authorized tasks, so static permissions alone cannot show whether its current authority is still appropriate.
- Discovery support grows by 35 local agent types, to 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot, with a unified registry covering ownership, activity and risk.
- Microsoft Entra Agent ID extends to more agent types, including locally discovered ones, to separate employee actions from agent actions.
- The Microsoft Execution Container isolates the agent runtime so it does not inherit unrestricted device access.
- Dynamic Permissions grant task- and time-scoped authority. Tool calls, APIs, Model Context Protocol servers and network paths stay under enterprise enforcement.
- Dynamic Agent Risk combines identity, endpoint, data, cloud, network, runtime and user signals to reassess exposure continuously. Dynamic Conditional Access acts on that score by reducing permissions, limiting network access, revoking privileges or requiring human approval.
- Guardian Agents and Playbooks investigate risks and coordinate protective actions within organizational policy.
Remediação
- Keep access controls outside the models so agents cannot bypass or manipulate enforcement.
- Contain a suspect agent rather than shutting it down: keep read access, remove approval or write privileges, restrict resources, and require verified human authorization for significant actions. Isolate the runtime or stop the agent in high-risk cases.
- Give agents distinct identities, task-scoped permissions and controlled execution environments, and maintain a registry of agents with owners and risk.
Linha do tempo
-
Microsoft warns enterprise AI agents can be hijacked via prompt injection; expands Project Perception containment controls
ler a análise desta fonte ocultar
Microsoft has warned that AI agents with access to enterprise systems can be manipulated through prompt injection, compromised inputs or shifts in task context. Agents do not need malicious intent to cause harm: their ability to read corporate data, invoke tools, approve transactions and talk to other agents widens exposure once untrusted content influences their decisions. Microsoft is extending Project Perception with controls to identify agents, limit their authority and contain unsafe behavior without relying on models to police themselves. The article describes a vendor security roadmap and warning, not an observed in-the-wild campaign.
Technical Details
- Microsoft's example is an expense-approval agent that reads an external document containing an injected prompt. Its configuration stays unchanged, but its behavior shifts to actions outside its authorized tasks, so static permissions alone cannot show whether its current authority is still appropriate.
- Discovery support grows by 35 local agent types, to 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot, with a unified registry covering ownership, activity and risk.
- Microsoft Entra Agent ID extends to more agent types, including locally discovered ones, to separate employee actions from agent actions.
- The Microsoft Execution Container isolates the agent runtime so it does not inherit unrestricted device access.
- Dynamic Permissions grant task- and time-scoped authority. Tool calls, APIs, Model Context Protocol servers and network paths stay under enterprise enforcement.
- Dynamic Agent Risk combines identity, endpoint, data, cloud, network, runtime and user signals to reassess exposure continuously. Dynamic Conditional Access acts on that score by reducing permissions, limiting network access, revoking privileges or requiring human approval.
- Guardian Agents and Playbooks investigate risks and coordinate protective actions within organizational policy.
Remediation
- Keep access controls outside the models so agents cannot bypass or manipulate enforcement.
- Contain a suspect agent rather than shutting it down: keep read access, remove approval or write privileges, restrict resources, and require verified human authorization for significant actions. Isolate the runtime or stop the agent in high-risk cases.
- Give agents distinct identities, task-scoped permissions and controlled execution environments, and maintain a registry of agents with owners and risk.