What happened
VentureBeat reported research by Capsule Security showing that text typed into a public SharePoint form could override a Microsoft Copilot Studio agent's instructions and make it email customer data from SharePoint Lists to an attacker through Outlook (named ShareLeak, CVE-2026-21520, patched Jan. 15, 2026). A similar attack through public lead forms hijacked Salesforce Agentforce agents (PipeLeak). Salesforce said it remediated the specific scenario and has human confirmation on by default for email actions; Capsule says Custom Topics remain exploitable. (VentureBeat, April 15, 2026)
Note on figures: Findings come from a security vendor's research as reported by VentureBeat; Salesforce disputes part of it.
What it means for Canada
Both platforms are in use at Canadian companies: our own directory lists Canadian Agentforce deployments (Trudel Immeubles, Uni-Recycle, Young Drivers of Canada), and Microsoft 365 is common across Canadian business. Any agent that reads public form input, can see customer data and can send email has this exposure.
- Sectors
- Any business running customer-facing AI agents · Property management, education and services (Agentforce users) · Microsoft 365 organizations
- Tools involved
- Microsoft Copilot Studio · SharePoint forms and Lists · Outlook actions · Salesforce Agentforce
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the OPC, notify affected people, keep a record of every breach
Quebec Law 25
Takeaways for Canadian businesses
- BusinessAudit every Copilot Studio agent triggered by SharePoint forms and review the Nov. 24, 2025 to Jan. 15, 2026 window for signs of data leaving.
- BusinessRestrict agent email actions to your own organization's domains.
- BusinessReview Agentforce automations triggered by public web-to-lead or other public forms, and keep human confirmation on email actions.
- BusinessLimit which SharePoint Lists and CRM records each agent can read to what its task needs.
- BusinessIf customer data left through an agent, assess real risk of significant harm and report to the OPC (and the CAI in Quebec) if it applies.
For the Canadian AI sector
Canadian agencies and consultancies that build agents on these platforms for clients need to test for prompt injection before handing them over.
Written by AgentsNorth from the source below. General information, not legal or security advice.