Prompt injection vulnerabilities in Microsoft and Salesforce AI agents exposed
Capsule Security discovered two indirect prompt injection vulnerabilities in Microsoft Copilot Studio and Salesforce Agentforce that could allow attackers to manipulate agents and exfiltrate data. Microsoft patched its vulnerability in January 2026, while Salesforce had not publicly addressed its flaw as of April 2026.
What happened
Capsule Security discovered two indirect prompt injection vulnerabilities in AI agent platforms. The first vulnerability, named 'ShareLeak' and assigned CVE-2026-21520 with CVSS score 7.5, was found in Microsoft Copilot Studio; an attacker could fill a public-facing SharePoint form comment field with a crafted payload to inject a fake system role message, causing the agent to concatenate the malicious input directly with its system instructions with no input sanitization.
The second vulnerability, called 'PipeLeak,' is a parallel indirect prompt injection vulnerability in Salesforce Agentforce. Microsoft patched ShareLeak on January 15, 2026, and assigned the CVE. Salesforce has not assigned a CVE or issued a public advisory for PipeLeak as of April 15, 2026.
Reported impact
In Capsule's proof-of-concept testing, the injected payload overrode the agent's original instructions, directing it to query connected systems. Capsule's research indicates that the vulnerability enables data exfiltration despite patches, signaling a new vulnerability class that cannot be fully eliminated by patches alone.
Index analysis
The vulnerabilities exploit a gap between when an AI agent receives a prompt and when it executes an action, during which it can be manipulated or silently exfiltrate data. Capsule noted that Microsoft's decision to assign a CVE to a prompt injection vulnerability in an agentic platform is 'highly unusual,' though Microsoft previously assigned CVE-2025-32711 to EchoLeak, a prompt injection in M365 Copilot in June 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.