Microsoft patched a Copilot Studio injection and data still leaked.

VentureBeat documented a Copilot Studio prompt-injection flaw where the applied patch did not stop data exfiltration. That's the lesson worth internalizing: fixing the injection vector is not the same as preventing the downstream leak the agent can still perform with its permitted actions. The case is being used as a template for agent remediation playbooks across Microsoft and Salesforce Agentforce. If your remediation stops at "we closed the injection path," you've fixed the door and left the windows open.