ShareLeak. The access path.
A SharePoint comment field overrode a Copilot Studio agent's system instructions. The agent ran in its default configuration. Nothing stood between a form field and its data access.
The record
Entry point. SharePoint form comments field, attacker payload in a field the agent reads.
The identity in the middle. The agent standing connection to SharePoint Lists plus its outbound email action, with no per task identity scoping between the injected text and that access.
What was reached. non-organizational email, customer data emailed outside the tenant.
A SharePoint comment field overrode a Copilot Studio agent's system instructions.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| SharePoint form comments field | Entry | attacker payload in a field the agent reads |
| form submission | Step | the payload is concatenated with the agent system instructions |
| agent instructions | Step | the injected text overrides the legitimate system prompt |
| connected SharePoint Lists | Step | the agent reads customer data with its standing connection |
| non-organizational email | Reached | customer data emailed outside the tenant |
Where a breakpoint would have been
The gap between the form and the context window. System instructions are not a boundary when user content is appended to them. The durable fix is scoping what the agent may read and where it may send, so an override changes the wording and not the reach.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the ShareLeak incident?
The published path starts at SharePoint form comments field, attacker payload in a field the agent reads.
What did it reach?
The last step in the published path is non-organizational email, customer data emailed outside the tenant.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.