--- title: "Your AI Agents Just Got Their First CVE. The Safety Net Didn't Hold." author: True Horizon AI url: https://truehorizon.ai/news/your-ai-agents-just-got-their-first-cve-the-safety-net-didn-t-hold description: "True Horizon's guide to build secure agents." --- # Your AI Agents Just Got Their First CVE. The Safety Net Didn't Hold. > True Horizon's guide to build secure agents. Earlier this year, security researchers at Capsule Security disclosed two vulnerabilities in the biggest names in enterprise AI agents. One, nicknamed "PipeLeak," sat in Salesforce's Agentforce. The other, "ShareLeak," was in Microsoft's Copilot Studio and got a formal identifier, [CVE-2026-21520, with a severity score of 7.5](https://www.darkreading.com/cloud-security/microsoft-salesforce-patch-ai-agent-data-leak-flaws). Both were the same class of flaw: an attacker could hide a malicious instruction inside the data an agent reads, and get the agent to leak information back out. Only the Microsoft flaw was assigned a formal CVE; Salesforce patched PipeLeak without one, which is its own quiet signal about how new all of this still is. The detail that should stop every CISO is what happened in the Copilot case. According to the researchers, the data was exfiltrated even after Microsoft's own safety mechanism flagged the attack. The guardrail saw the problem, and the data left anyway. ## Prompt injection is now the default attack For years, prompt injection, hiding hostile instructions inside content an AI processes, was discussed as a theoretical weakness. These disclosures move it firmly into the practical column. If the technique works against Salesforce and Microsoft's flagship agents, it works, and any enterprise threat model that doesn't assume it is already out of date.What makes agents uniquely exposed is that they don't just read, they act. A chatbot that gets tricked says something wrong. An agent that gets tricked can take an action: pull a record, send a file, update a system. The instruction and the data flow through the same channel, which is exactly what these attacks exploit, and it's why an agent with broad access is a far bigger liability than the same flaw in a passive tool. ## The lesson in the safety-net failure The most important takeaway isn't that Salesforce or Microsoft got something wrong. Serious vendors ship vulnerabilities, patch them, and move on, the same as any software company. The takeaway is what the Copilot case proved about relying on a vendor's built-in safety filter as your primary control. It flagged the attack and failed to stop it, which means the filter is one layer of defense. It is not a foundation you can build a security program on.For an enterprise, that reframes the whole approach. The question isn't whether your agent vendor has safety features. Assume it does, and assume they'll be bypassed. What matters is what your own controls do when that happens, because these flaws just showed that it can. ## Scope is the control you actually own There's one lever an enterprise fully controls, and it's the most underused: how much any given agent can reach. An agent can only leak what it has access to. Most are provisioned with far more than the job requires, wired into an entire CRM or file store when the task needed a slice of it. That access is a decision, and it's the difference between a contained incident and a breach. For agents, least privilege is the blast-radius control. It decides how bad the inevitable compromise gets. ## How True Horizon does it We build enterprise agents on the assumption that they will be attacked. That means scoping every agent to the least data and fewest actions its job actually needs, so a successful prompt injection can only reach a little. It means putting agents through the same security review and monitoring as any other production system, rather than treating them as a feature that got switched on. And it means never leaning the whole defense on a vendor's built-in filter, because the ShareLeak case is a clear demonstration of what happens when that's the only thing standing between an attacker and your data. ## What to do now Take these flaws as a prompt to treat agents like the production software they are. Put every agent through your normal security review. Scope each one to the minimum access its job requires. Give agent patching and monitoring a named owner, so you hear about the next vulnerability from an advisory rather than an incident. And assume prompt injection will land eventually, then design so that when it does, the agent can't reach anything worth stealing.The agents are already software with access to your most important systems. They deserve the same security discipline as anything else that can touch your data. If you want to know what your AI agents could actually reach if one were compromised tomorrow,  [take our AI assessment](http:///assessment) and we'll map the blast radius before someone else does. Source: https://truehorizon.ai/news/your-ai-agents-just-got-their-first-cve-the-safety-net-didn-t-hold