Microsoft Warns AI Agents Can Be Hijacked Through Prompt Injection Attacks

Microsoft has issued a warning about the risks posed by AI agents that access enterprise systems, especially when attackers manipulate them through methods like prompt injection, compromised inputs, or shifts in task context.

To address this issue, the company is enhancing Project Perception with controls to identify agents, limit their authority, and manage unsafe behavior without relying on models to regulate themselves.

The warning highlights an important distinction: agents don’t need malicious intent to cause harm. Their ability to read corporate information, invoke tools, approve transactions, and communicate with other agents increases exposure when untrusted content influences their decisions.

Microsoft CEO Satya Nadella argues that organizations need to separate intelligence from authority. Place access controls outside the models so they cannot bypass or manipulate enforcement mechanisms.

Microsoft Warns AI Agents

Microsoft illustrates this threat with an expense-approval agent authorized to review submissions, check policies, and approve routine reimbursements. If this agent encounters a prompt injection embedded in an external document, its behavior may change to undertake actions unrelated to its authorized tasks.

The critical issue is that while the agent’s configuration may remain unchanged, its behavior can become unsafe. Therefore, static permissions alone cannot determine whether the agent’s current authority is still appropriate.

Microsoft’s proposed response is containment: maintain legitimate operations while limiting higher-risk actions. An affected agent could keep read access but lose approval or write privileges, face restrictions on available resources, or require verified human authorization before executing significant actions. In high-risk situations, security controls might isolate the agent’s runtime or cease its operations altogether.

The revised approach combines agent discovery, distinct identities, controlled execution environments, and restricted access paths. Microsoft plans to expand discovery support by adding 35 new local agent types, bringing the total to 60, including Claude Code, OpenAI Codex, and GitHub Copilot. A unified registry will enhance visibility into ownership, activity, and risk.

Microsoft Entra Agent ID is also being extended to additional agent types, including locally discovered ones. This separation helps distinguish employee actions from those agents perform on their behalf.

Runtime isolation serves as another protective boundary. The Microsoft Execution Container creates a controlled environment that prevents agents from inheriting unrestricted device access.

Dynamic Permissions will grant authority for specific tasks and durations rather than automatically replicating an employee’s existing permissions. Tool calls, APIs, Model Context Protocol servers, and network pathways will remain subject to enterprise enforcement.

Dynamic Agent Risk combines signals from identity, endpoints, data, cloud services, network activity, runtime conditions, and user actions to reassess exposure continuously.

Dynamic Conditional Access uses these assessments to enforce coordinated restrictions, such as reducing permissions, limiting network access, revoking certain privileges, or requiring human approval.

Guardian Agents and Playbooks are designed to investigate potential risks and coordinate protective actions within the boundaries established by organizational policies.

These enhancements will further extend Project Perception, a framework Microsoft introduced to connect security signals, context, models, agents, and enforcement mechanisms.

Microsoft’s overarching message is that while transparency can improve detection, it cannot replace independent enforcement. AI agents must remain observable and restricted throughout execution, ensuring organizations retain control over what they can access, modify, invoke, or approve.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.