Microsoft Copilot Dataverse: Hidden Security Risks Exposed

Phantom Labs uncovered hidden security risks and trust boundaries within Microsoft Copilot Dataverse. This platform is used for building AI agents that automate business processes. Researchers used a legitimate Dataverse feature, custom .NET assembly plugins, to gain administrative access to sandboxed plugin containers. They then exfiltrated and reverse-engineered DLLs, discovering that Microsoft's stated security boundaries did not hold. Plugins had broad network and file system access, contrary to documentation. Microsoft confirmed these containers are treated as hostile multi-tenant environments. A malicious plugin from Microsoft's AppSource marketplace could intercept private data in a shared container. This research highlights the importance of securing AI platforms, especially identity and privilege, as AI agents become more integrated into enterprise systems.