Microsoft Azure and the Power Platform allow businesses to use Logic Apps and Power Automate respectively to automate simple tasks with complex cloud work, and integrating AI agents such as Copilot Studio to let employees control cloud resources with natural language. To keep things secure, developers often opt for secure, passwordless environments where different Azure services can communicate with each other seamlessly.

​

In these setups, Copilot agents act as the operational brain. These agents are connected to Power Automate flows that have the power to perform high-level actions, such as managing Azure resources. Now, because these workflows stay within the Azure, security teams often assume the input is safe.

​​

In this webinar, we will explore how a threat actor can pivot from a single compromised identity to controlling high-value cloud resources by exposing hidden links between corporate identities and automated AI workflow. We will demonstrate how Prompt Injection can trick a Copilot agent into abusing its own internal tools to leak sensitive data, all while bypassing traditional security filters. Finally, we will discuss the security steps to harden automation and protecting cloud data from being exploited by "intelligent" agents.