Microsoft

11 reports

All LLM Security Agentic AI Industry News Supply Chain Research Prompt Injection First Look: Security Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning AI Security Tools Deep Signal Intelligence Report Security Operations

Microsoft Copilot Super App Merges Chat, Code, and Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Verge AI Jul 30, 2026

Microsoft has confirmed a Copilot 'super app' launching in 2026 that consolidates chat, GitHub Copilot coding, Cowork collaboration, and agentic Autopilot capabilities into a single unified platform spanning consumer and commercial users. The convergence of these surfaces into one application dramatically expands the blast radius of any successful prompt injection or account compromise, as an attacker who subverts the LLM layer could pivot across coding pipelines, autonomous task execution, and business workflows simultaneously. Defenders should treat this consolidation as a significant privilege-escalation risk, where a single vulnerability in the AI layer now potentially unlocks lateral movement across the entire Microsoft productivity stack.

Microsoft Launches MAI-Cyber-1-Flash Inside MDASH Platform

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Hacker News Jul 28, 2026

Microsoft has introduced MAI-Cyber-1-Flash, a cybersecurity-specific sparse mixture-of-experts model integrated into its MDASH vulnerability identification and remediation harness, claiming 95.95% on the CyberGym benchmark at 50% lower cost than its previous model mix. The system's agentic architecture — routing roughly 90% of tasks to the specialised smaller model and escalating the hardest 10% to GPT-5.4 — expands the attack surface for adversaries who can probe the routing logic, manipulate vulnerability-related inputs, or abuse the automated proof-of-concept generation pipeline. Defenders should treat MDASH as a high-value target given its privileged access to unpatched source code and its capacity to produce working exploits, and should audit access controls, output handling, and supply chain integrity before deployment.

Azure DevOps MCP Prompt Injection Hijacks AI Review Agents

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jul 22, 2026

A prompt injection flaw in Microsoft's official Azure DevOps MCP server allows attackers to embed hidden instructions inside pull request descriptions using HTML comments, invisible to human reviewers but passed raw to AI agents. Because the affected tool lacks the spotlighting guardrail Microsoft already applied to other tools in the same server, a low-privileged contributor can hijack a senior reviewer's AI agent to exfiltrate secrets, trigger pipelines, and read confidential wikis across unrelated projects. The vulnerability represents a textbook confused-deputy escalation in an agentic AI workflow, confirmed unpatched as of July 21, 2026.

Microsoft MDASH Brings AI-Powered Windows Vulnerability Discovery

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jul 10, 2026

Microsoft has deployed MDASH (Multi-model Agentic Scanning Harness), an AI-powered agentic system that autonomously scans Windows binaries for vulnerabilities and validates findings through multiple AI models before human engineer review. The accelerated discovery pipeline means defenders will see a higher volume of Patch Tuesday fixes, compressing patch deployment windows and increasing pressure on enterprise patch management processes. Simultaneously, the same AI-accelerated vulnerability discovery capability is available to adversaries, raising the risk that threat actors identify and weaponise flaws faster than Microsoft's pipeline can remediate them.

Microsoft Copilot MCP Tool Poisoning Enables Data Exfiltration

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jul 04, 2026

Microsoft researchers have demonstrated how attackers can embed hidden instructions inside MCP tool descriptions to covertly redirect AI agents into exfiltrating sensitive business data. Because each individual action the agent takes appears legitimate — using approved tools and the user's own permissions — default security controls generate no alerts. The attack exploits a fundamental design tension in MCP: tool descriptions simultaneously carry operational instructions and attacker-controlled data, collapsing a critical trust boundary.

AutoJack: Microsoft AutoGen Studio RCE via MCP WebSocket

ATLAS OWASP HIGH ▲ 8.5 BleepingComputer Jun 23, 2026

A three-flaw vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio allowed attackers to execute arbitrary commands on a developer's host system by manipulating a browsing AI agent into connecting to a malicious webpage. The attack exploited missing authentication on MCP WebSocket routes combined with unsanitised base64-encoded parameters to launch arbitrary processes. Microsoft confirmed the flaw was patched before any PyPI release, limiting exposure to developers building directly from the main GitHub branch.

Miasma Worm Compromises 73 Microsoft NPM Packages for AI Agents

ATLAS OWASP CRITICAL ▲ 8.5 Ars Technica Security Jun 09, 2026

Seventy-three Microsoft-hosted open source packages were compromised with the Miasma credential-stealing worm, which activates specifically when developers open packages inside AI coding agents. The malware, attributed to threat actor TeamPCP, exploits legitimate OIDC token workflows and SLSA provenance attestation to bypass supply-chain integrity checks and spread laterally across cloud infrastructure. This marks the second such compromise of an official Microsoft repository in as many months, indicating a sustained campaign targeting developer toolchains and the AI-assisted development pipeline.

Microsoft RAMPART Tests AI Agents for Prompt Injection

ATLAS OWASP MEDIUM ▲ 7.2 The Hacker News May 22, 2026

Microsoft has released two open-source tools, RAMPART and Clarity, aimed at embedding security testing into AI agent development workflows. RAMPART extends the existing PyRIT framework with a Pytest-native harness for running adversarial and safety tests against AI agents, explicitly covering cross-prompt injection, data exfiltration, and behavioural regression scenarios. Clarity operates as a pre-code design analysis tool, helping teams surface and challenge unsafe assumptions before an agentic system is built.

Microsoft MDASH Discovers 16 Windows RCE Flaws

ATLAS OWASP HIGH ▲ 7.8 The Hacker News May 14, 2026

Microsoft has disclosed MDASH, a multi-model agentic AI scanning system that autonomously discovered 16 vulnerabilities patched in May 2026's Patch Tuesday, including two critical RCE flaws. The system orchestrates over 100 specialised AI agents in a structured pipeline covering auditing, debating, and proof-of-exploitability stages. MDASH represents a significant shift in how AI is being deployed offensively and defensively within the vulnerability research lifecycle, with direct implications for how agentic AI systems are trusted, scoped, and governed.

CVE-2026-26030: Semantic Kernel RCE via Prompt Injection

ATLAS OWASP CRITICAL ▲ 9.2 Microsoft Security Blog May 08, 2026

Microsoft's Defender Security Research Team disclosed two CVEs in Semantic Kernel — a widely-used AI agent orchestration framework — demonstrating how prompt injection can escalate to remote code execution via compromised plugins. The vulnerabilities (CVE-2026-26030 and CVE-2026-25592) expose a systemic risk in the agentic AI layer: because frameworks like Semantic Kernel abstract tool orchestration, a single flaw in how LLM outputs are mapped to system tools can propagate across every application built on that foundation. This research signals a critical shift in AI threat modelling, where prompt injection is no longer a content risk but an execution risk.

ML Supply Chain Compromise in DoD AI Integration

ATLAS OWASP HIGH ▲ 6.5 SecurityWeek May 04, 2026

The US Department of Defense has formalised agreements with seven major technology companies — including Google, Microsoft, OpenAI, and Amazon Web Services — to integrate AI into classified military networks for battlefield decision support. The move raises significant AI security concerns around human oversight, adversarial manipulation of high-stakes AI systems, and supply chain risks introduced by multiple commercial vendors operating within classified environments. Notably, Anthropic was excluded following a public dispute over AI safety and ethics in warfare.

Microsoft

Stay ahead of the threat.