An AI agent does what it reads. If it reads a message written by an attacker, it may follow that message too. Three disclosures in fifteen months show how real this risk has become for organisations that connect agents to business data.
What happened
On 15 April 2026, Capsule Security published two vulnerabilities in widely used AI agent platforms. ShareLeak affected Microsoft Copilot Studio and was assigned CVE-2026-21520. PipeLeak affected Salesforce Agentforce. In both cases, an attacker who could type into an ordinary form could make a company's AI agent send data to them.
Microsoft fixed the issue on its side with no customer action needed. Salesforce called PipeLeak "configuration-specific", said it had remediated the scenario and pointed customers to optional human-approval controls. These were research demonstrations: there is no confirmed evidence they were exploited in the wild.
How the attack worked
In ShareLeak, an attacker writes instructions into a SharePoint form field. Later, when the agent processes that list, it treats the text as an instruction, pulls customer names, addresses and phone numbers from SharePoint and emails them to the attacker. According to reporting on Capsule's tests, data still left the system even when Microsoft's safety mechanisms flagged the activity.
PipeLeak works the same way through a public lead form. When a staff member asks the agent to process new leads, it executes the hidden instructions, retrieves CRM records and emails them out.
This is a pattern, not a one-off. In June 2025, EchoLeak (CVE-2025-32711) showed that a single crafted email could make Microsoft 365 Copilot leak data with no click at all, by hiding instructions that Copilot later followed. In September 2025, ForcedLeak showed Agentforce leaking CRM data through a web-to-lead form and an expired allowlisted domain that cost about £4 to register.
Why it matters for your organisation
Organisations are deploying agents that read inbound email, web forms, supplier documents and customer uploads. All of that is text written by outsiders. If the same agent can also search internal files and send email, an attacker can try to give it orders.
The fix cannot rely on the model alone noticing bad instructions. The security has to come from what the agent is allowed to do.
What to do now
- Separate reading from acting. An agent that processes untrusted content should not also be able to send email or export data without approval.
- Limit data access. Give each agent access only to the lists, folders and records its task requires.
- Require human approval for outbound messages, external sharing and bulk retrieval.
- Restrict destinations. Allow agents to send only to approved domains and recipients.
- Log and review agent actions, and test your agents with prompt injection scenarios before and after deployment.
How Blacknote helps
Our AI & Agentic Security service tests your Copilot, Agentforce, ChatGPT and custom agents for prompt injection and data leakage, then puts permission boundaries, approval steps and logging in place so that AI can help your teams without endangering confidential data.
Sources
- CSO Online: Copilot and Agentforce fall to form-based prompt injection tricks
- CVE record: CVE-2026-21520
- OECD AI Incidents Monitor: Prompt injection attacks in Microsoft and Salesforce AI agents
- arXiv: EchoLeak, the first real-world zero-click prompt injection exploit
- The Hacker News: Zero-click AI vulnerability exposes Microsoft 365 Copilot data
- The Hacker News: Salesforce patches critical ForcedLeak bug