Copilot Studio and Agentforce Security Review: What to Test Before Go-Live

A Copilot Studio security assessment or Agentforce security testing engagement checks the agent you built, not the platform you built it on. Before go-live, test the authentication mode, every connector and action, whose credentials each tool uses, which knowledge sources the agent can read, and whether untrusted email, documents or web forms can make the agent leak data or take actions.

Low-code platforms are good at one thing that worries security teams: they let a business user connect a language model to Outlook, SharePoint, Dataverse or a Salesforce org in an afternoon. The platform handles hosting, identity plumbing and model safety. Your configuration decides what the agent can reach, and that is where the test needs to focus.

What has actually gone wrong with these platforms?

Every public incident below starts the same way: the agent read text an outsider controlled, then used legitimate access to move data.

Sources: The Hacker News on EchoLeak, Zenity Labs AgentFlayer write-up, The Hacker News on ForcedLeak, and The Hacker News on CVE-2024-38206.

Two lessons. Vendors fix platform bugs fast, so the residual risk sits in your build. And Zenity’s point stands: an agent that reads untrusted text and holds broad access can be steered, whatever the vendor patches. That is the agent hijacking problem in a low-code wrapper.

What is the Copilot Studio attack surface?

Microsoft documents a long list of controls for Copilot Studio. The ones that matter most in a test:

• Authentication mode. Agents use No authentication, Authenticate with Microsoft, or Authenticate manually. Microsoft’s own docs warn that “No authentication” lets anyone with the link chat with the agent. We check which mode is set, whether Require users to sign in is on, and whether a public channel exposes an agent that was built for staff.
• Tool credentials. Each tool runs with End user credentials or Maker-provided credentials. A maker-provided connection means every chat user borrows the author’s access. This is the single most common over-permissioning pattern we look for.
• Connectors, REST APIs, MCP servers and agent flows. Every tool is a path out. We map what each can read and write, and whether “Ask the end user before running” is on for anything destructive.
• Knowledge sources. SharePoint, OneDrive, uploaded files and public websites. A public website or a SharePoint site that outsiders can write to is an indirect prompt injection channel.
• HTTP request nodes and event triggers. Raw outbound HTTP is an exfiltration route, and triggers let an agent act with no human in the loop.
• Data policies (DLP). Admins classify Copilot Studio connectors as Business, Non-business or Blocked in the Power Platform admin center. Blocking Chat without Microsoft Entra ID authentication in Copilot Studio forces authentication; the HTTP connector and public website knowledge support endpoint filtering. We verify these policies exist and actually apply to the environment the agent lives in.
• Maker permissions and environments. Who can create, edit and publish agents, whether makers build in the default environment, and whether audit logs reach Microsoft Purview or Sentinel.

Source: Microsoft Learn pages on security and governance, user authentication, data policies and tools.

What is the Agentforce attack surface?

Agentforce has a different shape but the same questions:

• Topics, now subagents. Salesforce renamed topics to subagents in April 2026 with no functional change. Each one scopes which instructions and actions apply. We test whether a user can talk their way into a subagent meant for verified customers or staff.
• Actions. Flows, Apex, prompt templates and API calls. Actions run with the permissions of the running user, so a broad flow behind a harmless-sounding action is a privilege escalation path.
• The agent user. Service agents get a dedicated agent user that starts with minimal access. Depending on how the customer is identified, the agent runs as that agent user or as the authenticated customer. We review the permission sets granted to it, object and field access, and what an unverified visitor can reach.
• Untrusted CRM data. Web-to-Lead, Web-to-Case, email-to-case, chat transcripts and knowledge articles all feed text the agent will read. ForcedLeak used exactly this path.
• The Trust Layer. Salesforce lists secure data retrieval, dynamic grounding, data masking, zero data retention with model providers, toxicity detection and security guardrails. These reduce risk, but they do not decide what your actions are allowed to do. We also check that Trusted URLs are tight and that no expired or broad domains sit on the list.

What does a pre-go-live test plan look like per platform?

The OWASP Top 10 for Agentic Applications, published in December 2025, gives you shared language for findings. Agent Goal Hijack (ASI01), Tool Misuse and Exploitation (ASI02) and Identity and Privilege Abuse (ASI03) cover most of what we find in low-code agents. Where the agent connects to MCP servers, we fold in our MCP server security assessment checks.

How do we run the test in practice?

1. Export and inventory. We review the agent configuration, every tool, connection owner, knowledge source and data policy in scope.
2. Threat model the inputs. For every knowledge source and trigger: can someone outside your organisation write to it?
3. Attack with a normal user account, then an unauthenticated one if any channel allows it.
4. Plant indirect payloads in the real input channels: an email to the monitored inbox, a lead form, a shared document.
5. Try to move data out through every tool that can write, send or render a link.
6. Report, fix, retest. Each finding comes with the conversation transcript, the configuration cause and a concrete fix, usually a credential mode, a permission set or a data policy change.

What evidence should you hand UAE auditors?

There is no UAE rule that says “test your Copilot Studio agent”, so do not let anyone sell you one. What exists is broader. The CBUAE AI guidance note (23 February 2026) expects licensed financial institutions to show governance and accountability, human oversight and sound data management for AI. DESC sets security expectations for Dubai government entities and their suppliers, covered in our Dubai government agentic AI checklist. Our guide to UAE AI security testing requirements maps the rest.

A practical evidence pack:

• Agent inventory with owners, environments and channels
• Configuration export showing auth mode, tool credential modes and data policies
• Test plan mapped to OWASP agentic and LLM categories
• Findings with transcripts, severity and business impact
• Fix records and a dated retest
• Ongoing controls: audit logging, change control for agents, re-test triggers

How much does a platform-agent review cost?

It scales with the number of agents, tools and back-end systems rather than the platform. A single agent sits close to a single-application LLM test; our AI red teaming cost guide explains the drivers and where multi-agent work lands.

Book a fixed-scope platform-agent security review

pentest.ae offers a fixed-scope Copilot Studio or Agentforce security review: one agent, its tools, knowledge sources and permissions, tested with direct and indirect prompt injection, reported against the OWASP Top 10 for Agentic Applications, with a retest included. For estates with many agents or autonomous triggers, we scope an agentic red team instead.