Proofpoint shows how one approval can put a bad AI agent in a firm

Researchers at Proofpoint report an attack on Microsoft Entra Agent ID, which gives AI agents digital identities and sets the data that they can get. The attacker makes a bad blueprint, a template for agent identities, and sends a web address to a victim. If the victim accepts it, the agent of the attacker is in the firm.

How it works

The web address goes to a page from Microsoft, and no copy of the login page is necessary. The attacker must know the tenant ID of the firm and one target user. After approval, the agent can make more identities and get access tokens, then send data out.

The numbers

One blueprint holds a maximum of 250 agent identities. Proofpoint tells that the blueprint ID is the same in all tenants that accept it, which helps to find known bad agents. The source does not tell of an attack in use.

What is not known

Admin permissions are necessary for permissions for the full firm. Some users can accept lower permissions, if the policy of the firm lets them. The source does not tell how many firms are open to this, or the position of Microsoft.

Insight: The new risk is a person who accepts a bad agent

In October 2026, Symantec found a bad agent that can do a maximum of 100,000 attack steps without a person. Google saw hackers use agent tools. Here the attacker must get a person to accept a blueprint, and this reads as a move of the risk from code to approval rules. Your approval rules for external agents are a safety control.