Hackers Leverage Copilot AI in SharePoint to Extract Passwords and Sensitive Data

This report highlights security risks introduced by Microsoft Copilot for SharePoint—agents with broad access can expose sensitive data through misconfigurations, bypass SharePoint's restricted view, and enable stealthy enumeration; custom agents and a referenced SSRF vulnerability (CVE-2024-38206) further expand the attack surface. It recommends strict access controls, content hygiene, monitoring, and layered security to mitigate potential data exposure and misuse.