Microsoft

AI Agent ARTEX Weaponised in ConnectWise Supply Chain Breach

ATLAS OWASP CRITICAL ▲ 8.2 TechCrunch AI Oct 23, 2026

Chinese state-aligned hackers breached ConnectWise's cloud backup service, stealing application credentials to access thousands of corporate Microsoft-hosted environments. The attackers deployed ARTEX, an open-source AI agent framework, to automate intrusions across approximately 2,250 organisations at nearly 3,000 sign-in attempts per minute. The incident marks a significant escalation in adversarial use of AI agents for large-scale, high-velocity credential-based attacks.

Microsoft Launches Guardian Agents to Monitor AI Agent Behaviour

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 TechCrunch AI Oct 20, 2026

Microsoft has introduced Guardian Agents, a monitoring layer within its Project Perception platform designed to observe, assess, and control AI agents operating inside enterprise environments. This closes a meaningful gap for defenders by providing an independent oversight layer that separates the authority to act from the supply of AI intelligence — treating deployed agents as insider-threat-equivalent principals requiring continuous monitoring. Residual gaps remain around cross-vendor agent coverage, the maturity of behavioural baselines needed to distinguish anomalous from normal agent activity, and the operational overhead of standing up independent control planes at scale.

Microsoft Copilot Gains Local File Access via Hybrid Intelligence

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 The Verge AI Oct 08, 2026

Microsoft has announced Hybrid Intelligence for Copilot, enabling the AI assistant to access local files, execute multi-step OS-level actions, and coordinate between local and cloud AI models on Windows PCs. For defenders, this represents a meaningful evolution in understanding how agentic AI systems interact with endpoint data and OS surfaces — a pattern that security teams now need to account for in endpoint policy and data governance frameworks. The capability arrives without detailed disclosure of permission scoping, audit logging, or consent controls, leaving security teams with open questions about how to govern Copilot's access to sensitive local assets.

Microsoft: Attackers Gaining AI Edge in Vulnerability Exploitation

ATLAS OWASP HIGH ▲ 7.5 BleepingComputer Oct 03, 2026

Microsoft's 2026 Digital Defense Report warns that threat actors are currently outpacing defenders in adopting AI for offensive operations, including accelerated vulnerability discovery, AI-generated malware, and automated post-compromise activity. The report highlights a critical asymmetry: AI is compressing weaponization timelines to under 24 hours while remediation cycles remain slow, creating a multi-year window of elevated risk from unpatched vulnerabilities. Well-funded adversaries may exploit this gap to stockpile zero-days discovered through AI-assisted research.

Microsoft Uses AI to Ship Record 974-Vulnerability Patch Batch

FIRST LOOK ATLAS OWASP HIGH ▲ 6.2 Krebs on Security Sep 09, 2026

Microsoft's September 2026 Patch Tuesday delivers 974 fixes in a single release, explicitly crediting AI-assisted vulnerability discovery for the accelerated pace and volume of findings. This represents a meaningful defensive advance: AI is now closing the gap between vulnerability existence and vendor awareness, surfacing flaws faster than traditional research cycles allowed. The residual challenge is on the defender side — patch testing, prioritisation, and deployment capacity have not scaled at the same rate as AI-accelerated discovery, creating an operational backlog risk that organisations must actively manage.

CVE-2026-55040: SharePoint RCE Chain Found via AI Agent

ATLAS OWASP CRITICAL ▲ 7.2 The Hacker News Aug 12, 2026

Rapid7 researchers disclosed a critical unauthenticated RCE exploit chain against Microsoft SharePoint on-premises editions, chaining CVE-2026-55040 (CVSS 9.1) with CVE-2026-63520 (CVSS 8.1). Notably, an AI agent played a significant role in discovering the two-vulnerability path across 24 active research days, though human expert oversight was required to correct model errors and prevent the agent from overstepping its operational boundaries. The disclosure highlights both the offensive utility and current limitations of agentic AI in vulnerability research.

Microsoft Launches Zero Trust for AI Agent Security Tools

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 Microsoft Security Blog Aug 05, 2026

Microsoft has released an expanded Zero Trust for AI strategy including a new AI-focused Zero Trust Assessment tool, a DevSecOps pillar in its Zero Trust Workshop, and an e-book covering security controls for autonomous and agentic systems. For defenders, this signals growing recognition that agentic AI pipelines introduce novel trust boundary failures that existing Zero Trust implementations do not adequately cover. Security teams should treat the new assessment tooling as a gap-analysis baseline while acknowledging that formalising AI agent governance also surfaces and codifies previously implicit attack surfaces attackers can now probe systematically.

Microsoft Copilot Super App Merges Chat, Code, and Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Verge AI Jul 30, 2026

Microsoft has confirmed a Copilot 'super app' launching in 2026 that consolidates chat, GitHub Copilot coding, Cowork collaboration, and agentic Autopilot capabilities into a single unified platform spanning consumer and commercial users. The convergence of these surfaces into one application dramatically expands the blast radius of any successful prompt injection or account compromise, as an attacker who subverts the LLM layer could pivot across coding pipelines, autonomous task execution, and business workflows simultaneously. Defenders should treat this consolidation as a significant privilege-escalation risk, where a single vulnerability in the AI layer now potentially unlocks lateral movement across the entire Microsoft productivity stack.

Microsoft Launches MAI-Cyber-1-Flash Inside MDASH Platform

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Hacker News Jul 28, 2026

Microsoft has introduced MAI-Cyber-1-Flash, a cybersecurity-specific sparse mixture-of-experts model integrated into its MDASH vulnerability identification and remediation harness, claiming 95.95% on the CyberGym benchmark at 50% lower cost than its previous model mix. The system's agentic architecture — routing roughly 90% of tasks to the specialised smaller model and escalating the hardest 10% to GPT-5.4 — expands the attack surface for adversaries who can probe the routing logic, manipulate vulnerability-related inputs, or abuse the automated proof-of-concept generation pipeline. Defenders should treat MDASH as a high-value target given its privileged access to unpatched source code and its capacity to produce working exploits, and should audit access controls, output handling, and supply chain integrity before deployment.

Azure DevOps MCP Prompt Injection Hijacks AI Review Agents

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jul 22, 2026

A prompt injection flaw in Microsoft's official Azure DevOps MCP server allows attackers to embed hidden instructions inside pull request descriptions using HTML comments, invisible to human reviewers but passed raw to AI agents. Because the affected tool lacks the spotlighting guardrail Microsoft already applied to other tools in the same server, a low-privileged contributor can hijack a senior reviewer's AI agent to exfiltrate secrets, trigger pipelines, and read confidential wikis across unrelated projects. The vulnerability represents a textbook confused-deputy escalation in an agentic AI workflow, confirmed unpatched as of July 21, 2026.

Microsoft MDASH Brings AI-Powered Windows Vulnerability Discovery

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jul 10, 2026

Microsoft has deployed MDASH (Multi-model Agentic Scanning Harness), an AI-powered agentic system that autonomously scans Windows binaries for vulnerabilities and validates findings through multiple AI models before human engineer review. The accelerated discovery pipeline means defenders will see a higher volume of Patch Tuesday fixes, compressing patch deployment windows and increasing pressure on enterprise patch management processes. Simultaneously, the same AI-accelerated vulnerability discovery capability is available to adversaries, raising the risk that threat actors identify and weaponise flaws faster than Microsoft's pipeline can remediate them.

Microsoft Copilot MCP Tool Poisoning Enables Data Exfiltration

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jul 04, 2026

Microsoft researchers have demonstrated how attackers can embed hidden instructions inside MCP tool descriptions to covertly redirect AI agents into exfiltrating sensitive business data. Because each individual action the agent takes appears legitimate — using approved tools and the user's own permissions — default security controls generate no alerts. The attack exploits a fundamental design tension in MCP: tool descriptions simultaneously carry operational instructions and attacker-controlled data, collapsing a critical trust boundary.

AutoJack: Microsoft AutoGen Studio RCE via MCP WebSocket

ATLAS OWASP HIGH ▲ 8.5 BleepingComputer Jun 23, 2026

A three-flaw vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio allowed attackers to execute arbitrary commands on a developer's host system by manipulating a browsing AI agent into connecting to a malicious webpage. The attack exploited missing authentication on MCP WebSocket routes combined with unsanitised base64-encoded parameters to launch arbitrary processes. Microsoft confirmed the flaw was patched before any PyPI release, limiting exposure to developers building directly from the main GitHub branch.

Miasma Worm Compromises 73 Microsoft NPM Packages for AI Agents

ATLAS OWASP CRITICAL ▲ 8.5 Ars Technica Security Jun 09, 2026

Seventy-three Microsoft-hosted open source packages were compromised with the Miasma credential-stealing worm, which activates specifically when developers open packages inside AI coding agents. The malware, attributed to threat actor TeamPCP, exploits legitimate OIDC token workflows and SLSA provenance attestation to bypass supply-chain integrity checks and spread laterally across cloud infrastructure. This marks the second such compromise of an official Microsoft repository in as many months, indicating a sustained campaign targeting developer toolchains and the AI-assisted development pipeline.

Microsoft RAMPART Tests AI Agents for Prompt Injection

ATLAS OWASP MEDIUM ▲ 7.2 The Hacker News May 22, 2026

Microsoft has released two open-source tools, RAMPART and Clarity, aimed at embedding security testing into AI agent development workflows. RAMPART extends the existing PyRIT framework with a Pytest-native harness for running adversarial and safety tests against AI agents, explicitly covering cross-prompt injection, data exfiltration, and behavioural regression scenarios. Clarity operates as a pre-code design analysis tool, helping teams surface and challenge unsafe assumptions before an agentic system is built.

Microsoft

Stay ahead of the threat.