TL;DR: Microsoft Copilot has pushed AI agent security into a data movement problem, because legacy DLP was not designed for machine-speed workflows across endpoints, browsers, SaaS, and MCP tool calls, according to Nightfall. The practical shift is toward real-time prevention, not visibility alone, because agentic workflows now cross both human and AI-controlled pathways.
At a glance
What this is: Nightfall argues that securing Microsoft Copilot now requires data control across agentic workflows, not just traditional DLP visibility.
Why it matters: IAM and security teams need controls that govern AI agent data movement, tool calls, and browser activity because Copilot-driven workflows can move sensitive data faster than legacy review and response models.
Context
Microsoft Copilot has changed where sensitive data flows, because users now move information through chat, browser, endpoint, SaaS, and tool-call paths that were not designed as a single governed control plane. Traditional DLP often sees fragments of that movement, but agentic workflows can cross surfaces too quickly for after-the-fact review to be enough.
The governance gap is not just visibility. It is the lack of inline control over machine-speed data movement when an AI system can read, transform, and forward content across multiple enterprise layers in one workflow. That creates a genuine identity and authorisation problem for AI agents, because access decisions now have to account for what the agent can do, not only what the human intended.
In that sense, Microsoft Copilot is a forcing function for broader AI data security. The challenge is typical of current enterprise AI adoption: organisations are trying to bolt data governance onto workflows that were built for autonomy, not for static permission review.
Key questions
Q: What breaks when AI agents are governed with legacy DLP controls?
A: Legacy DLP breaks because it assumes data moves through predictable human actions such as email, uploads, and endpoint copy events. AI agents use different transports, including IDE hooks, browsers, local MCP servers, and chained tool calls. If controls cannot see or stop those paths in real time, visibility turns into after-the-fact logging rather than effective prevention.
Q: Why do AI agents increase the risk of oversharing sensitive data?
A: AI agents often aggregate context from multiple sources, then present or transmit that information in ways a user would not normally see. If the agent’s access is broader than the user’s, or if data is sent to external tools without sanitisation, oversharing becomes a governance failure. The fix is to align workflow permissions, data minimisation, and user entitlements before deployment.
Q: What are the signs that AI data controls are not keeping pace with agentic workflows?
A: The clearest warning signs are unknown data access, unexplained sharing events, incomplete audit trails, and inconsistent visibility across security, legal, compliance, and executive teams. If teams cannot quickly answer what an agent touched, where it sent data, and who approved the workflow, controls are already lagging. Weak visibility usually means policy exists on paper but not in practice.
Q: How should security teams govern Copilot and similar AI tools?
A: Security teams should govern AI tools through identity, policy, and audit controls rather than treating them as separate exceptions. That means mapping who can use the tool, what data it can reach, and how actions are logged. If permissions, review cycles, and evidence trails are unclear, the deployment is not ready for regulated use.
Technical breakdown
Why legacy DLP struggles with agentic data movement
Legacy DLP was built around relatively linear human behaviour: a person opens a file, copies text, sends it, or uploads it. Agentic workflows are different because the system may inspect, summarise, transform, and re-route content across endpoints, browsers, SaaS apps, and API-mediated tool calls in a single session. That changes the control problem from detecting a leak to governing data motion itself. In practical terms, the security decision point moves closer to execution time, where policy has to understand context, destination, and agent capability rather than just content classification.
Practical implication: Treat AI agent activity as a governed data path, not as another endpoint event stream.
MCP tool calls as an access-control boundary
Model Context Protocol is not just another integration layer. In agentic environments it becomes a control boundary because it determines which external tools, data sources, and workflows an agent can invoke. That makes MCP security a question of authorisation scope, tool classification, and prompt-to-action trust. If an agent can reach a destructive or write-enabled tool through a loosely governed MCP server, the risk is not merely data exposure but downstream state change. For identity teams, this means agent permissions need to be reasoned about at the level of task authority, not broad application access.
Practical implication: Classify MCP tools by risk and restrict agents to the smallest task-scoped tool set possible.
Why real-time prevention beats visibility alone
Visibility tells you what happened. Prevention changes what can happen. In agentic environments, waiting for logs, dashboards, or retrospective review is often too late because the data may already have crossed a browser, SaaS boundary, or tool call. Real-time blocking, redaction, coach prompts, and automated remediation are therefore not optional extras; they are the operational layer that converts policy into control. This is especially important when the same workflow spans human input and AI execution, because security must interrupt unsafe movement before it becomes committed state or external disclosure.
Practical implication: Use inline enforcement on the surfaces where Copilot and agents can move sensitive data in real time.
Threat narrative
Attacker objective: The objective is to move sensitive enterprise data through trusted AI-assisted workflows before traditional controls can stop or even fully observe it.
- Entry occurs when a user or agent begins interacting with Copilot, a browser-based workflow, or an MCP-connected tool that can access enterprise content.
- Credentialed access and tool use then allow the agent to inspect, transform, or forward sensitive information across SaaS, endpoint, and workflow boundaries at machine speed.
- Impact follows when data leaves governed paths before legacy DLP or manual review can intervene, resulting in exfiltration, policy bypass, or unauthorised data transformation.
Breaches seen in the wild
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI agent security has become a data control problem, not just a policy problem. The article shows that Copilot-era risk is about where sensitive data moves, not only where it is stored. That shifts governance away from static classification and toward inline control of machine-speed workflows across endpoints, browsers, SaaS, and tool calls. Practitioners should treat data motion as the primary security object.
MCP creates a new authorisation boundary for agentic systems. Once agents can call external tools, access no longer means only application login rights. It means task authority, tool scope, and destructive capability have to be governed together. This is a material identity and NHI intersection: the agent becomes a non-human identity whose permissions must be scoped as tightly as any privileged service account. Practitioners should re-evaluate tool-level trust, not just user-level access.
Legacy DLP is being asked to do work it was never designed to do. Traditional controls assume relatively slow, human-driven data movement and retrospective review. Agentic workflows collapse those assumptions because content can be transformed and forwarded in one machine-speed chain. That exposes a governance gap we can call real-time data motion control: security has to intervene at the moment of movement. Practitioners should redesign enforcement around execution time, not post-event visibility.
Microsoft Copilot security is now inseparable from shadow AI governance. The article makes clear that enterprise users do not confine themselves to one sanctioned assistant. They use ChatGPT, Claude, Perplexity, and browser-based workflows alongside Copilot, which means controls must span multiple AI surfaces or risk blind spots. Practitioners should govern the whole AI access estate, not a single licensed product.
From our research library:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Security Guide
What this signals
Real-time data motion control: that is the control gap this article exposes. Security teams that still rely on visibility first and prevention second will continue to lose ground as AI agents compress decision, transformation, and transfer into a single workflow. The governance target has shifted from the file to the flow.
Agentic AI adds a genuine identity problem to an old data problem, because the system doing the moving is now a non-human actor with task-level authority. If that actor can invoke MCP tools, browse SaaS, and touch endpoint content, IAM and DLP have to converge around the same policy boundary.
A programme built for static review cannot keep pace with machine-speed workflows. The practical shift is toward inline enforcement, scoped tool access, and broader AI estate coverage, because the real control point is the moment data leaves governed context.
For practitioners
- Implement inline data motion controls Block, redact, or coach risky content as it moves through endpoints, browsers, SaaS apps, email, and AI agents rather than waiting for retrospective review.
- Scope AI agent permissions by tool risk Classify MCP and other agent tools as read, read-write, or destructive, then restrict each agent to the minimum task-scoped access it needs.
- Extend governance beyond Copilot Inventory the AI applications employees actually use, including shadow AI, so policy coverage matches the real workflow surface instead of only the licensed Microsoft stack.
- Tune policy for machine-speed workflows Test whether your DLP and CASB controls can stop data movement before it leaves the session, especially when prompts, summaries, and tool calls happen in one chain.
- Prioritise high-risk data classes first Apply the strictest controls to credentials, financial data, PHI, and sensitive business content that agents are most likely to transform or forward.
Key takeaways
- Copilot-era risk is less about detecting sensitive data and more about stopping it as it moves through AI-mediated workflows.
- Agentic AI forces identity teams to govern non-human task authority, not just human application access.
- Inline prevention, scoped tool access, and broader AI estate coverage are the controls that matter when workflows operate at machine speed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Copilot-connected agents with broad tool access mirror overprivileged non-human identities. |
| NHI-04 — Insecure Authentication | Agentic access across MCP and SaaS depends on brittle trust and session boundaries. | |
| NHI-10 — Human Use of NHI | Users are directing AI systems that act with machine authority on their behalf. | |
| Recommendation — Scope AI agents to task-level access and remove broad permissions that exceed their workflow need. Harden agent authentication paths and verify every tool-bound session before allowing access. Separate human intent from machine execution and review where users can trigger privileged agent actions. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The article centres on data access and movement that can be abused for theft or leakage. |
| Recommendation — Map agent-driven data movement to credential access and exfiltration techniques in your detection strategy. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is whether AI systems are entitled to move sensitive data across workflows. |
| Recommendation — Review and constrain AI entitlements under PR.AA-05 so agents only handle approved data paths. | ||
Key terms
- Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
- Data Motion Control: Data motion control is the ability to govern how information moves between applications, devices, users, and external destinations. It is distinct from simple access control because it focuses on the transfer path, not just who can open a file.
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security for practitioners building durable access controls. It helps identity and security teams align governance with real-world non-human access patterns across modern environments.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org