AI-Generated Workflows Are a Silent Security Disaster

Executive summary: A security analyst found sensitive HR documents being copied into a widely accessible Microsoft Teams channel due to an AI-generated Power Automate workflow; the report warns that AI coding assistants combined with Microsoft 365 automation lower the barrier to creating powerful but potentially over-permissive workflows that can silently expose data and create compliance and audit failures. It recommends treating AI-generated automation like code—enforcing least privilege, conducting reviews, maintaining inventory, and monitoring for new flows, permission changes, and unusual data movements.