<- All intelligenceMonitor
CISO
Enterprise Architect
Compliance Officer
Industry relevance
Financial Services
Healthcare
Government
MAY 7, 2026
Microsoft's Trust-and-Verify DLP Model for Copilot Has No Equivalent Check for Agent Actions, May 2026
Microsoft's DLP model verifies labeling accuracy. It has no equivalent check for whether an agent's action on correctly labeled data was authorized.
Microsoft Digital's Copilot governance guide, published May 7, 2026 and updated June 8, 2026, describes a trust-and-verify model for employee data handling: employees apply sensitivity labels, and Purview DLP automatically checks that work through auto-labeling, quarantining, and escalation to content owners, legal, and security teams. The guide states this model catches roughly one percent of cases where labeling goes wrong. The verification described applies to whether data is correctly labeled and accessible, not to actions an AI agent takes using that data.
GOVERNANCE IMPLICATION
DLP verification answers whether data is in the right place with the right label. It does not answer whether an autonomous agent's specific write, transaction, or recommendation using that data was authorized by a named accountable owner. An organization can pass every DLP check the guide describes while an agent takes an unauthorized action on perfectly labeled, perfectly permitted data, because the verification layer was built to catch mislabeling, not to evaluate business authorization.
SCENARIO
A logistics firm's Purview DLP environment is fully configured per Microsoft's guide and catches a credentials leak within minutes during a quarterly review. The same review asks whether a procurement agent's contract-amendment recommendation, generated using correctly labeled vendor data three weeks earlier, was authorized before being sent to a vendor. DLP has no record bearing on that question, because the recommendation involved no mislabeled or improperly accessed data.
THE GOVERNANCE QUESTION
Microsoft verifies employee labeling decisions through DLP. What verifies that an agent's specific action using correctly labeled data was a business decision someone authorized?
CONTROL GAP
Purview DLP verification, as described, evaluates label accuracy and data exposure. No equivalent automated verification layer exists in the guide for whether an agent's action on properly labeled data was authorized.
REGULATORY RELEVANCE
NIST Ai RMF
SEC Cyber
PRIMARY SOURCE
How we're tackling Microsoft 365 Copilot governance internally at Microsoft
Alex Fleck
May 7, 2026
Read the primary source ->(opens in new tab)CONTINUE READING
Read the next intelligence note.
OCTOBER 19, 2026
Agent SecurityMicrosoft Calls AI Agents Insiders and Introduces Task-Scoped, Time-Bound Agent Permissions, October 2026
On October 19, 2026, Microsoft published a post by Nadim Abdo, Corporate Vice President, Identity and Network Access, that treats AI agents already inside the enterprise as insiders. Microsoft says it is expanding discovery to 35 additional types of local agents, for a total of 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Microsoft says agents should begin with no authority and describes Dynamic Permissions scoped to the task and time-bound, with organization-wide policy setting the outer boundary. It also describes Dynamic Agent Risk, Dynamic Conditional Access, and Guardian Agents in Project Perception. The post says people define policy, approval boundaries, and delegation rules. It gives no availability dates for any capability.
JULY 1, 2026
Agent SecurityJADEPUFFER Ransomware Shows Autonomous Agent Executing Full Intrusion Chain After Human-Set Target, July 2026
Sysdig's Threat Research Team documented JADEPUFFER, published July 1, 2026, describing what it assesses as the first documented case of agentic ransomware. A human operator provisioned infrastructure, selected the victim, and supplied MySQL credentials obtained through a prior compromise. From initial access, an LLM agent autonomously executed reconnaissance, credential harvesting, lateral movement, persistence, and destruction against a production database server, exploiting a Langflow remote code execution flaw (CVE-2025-3248) and a 2021 Nacos authentication bypass (CVE-2021-29441). Sysdig director of threat research Michael Clark told CyberScoop a human set up and pointed the operation while the agent executed the technical chain unsupervised. The agent diagnosed a failed login attempt and deployed a working fix in 31 seconds, and ran more than 600 distinct payloads before encrypting 1,342 database configuration records and deleting the originals.
JUNE 30, 2026
Agent SecurityGuardFall Shell Injection Bypasses Approval Guards in 10 of 11 Open-Source AI Coding Agents, June 2026
Adversa AI researcher Omer Ben Simon published GuardFall on June 30, 2026, a class of shell-interpretation bypasses affecting open-source AI coding and computer-use agents. Testing found 10 of 11 surveyed agents (Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, and SWE-agent) vulnerable. The bypass exploits a mismatch between how approval guards inspect a proposed command and how Bash rewrites that command before execution, allowing decades-old shell tricks such as quote removal, IFS expansion, and command substitution to slip destructive commands past a filter that only reads the literal submitted text. Continue was the only tested agent found to substantially mitigate the issue. Adversa demonstrated end-to-end exploitation against the production Plandex binary. No CVE has been assigned, since the issue is a structural pattern across implementations rather than a single patchable flaw.