Dynamics 365 Supply Chain Management: Procurement Agent - Define custom scenarios for agent-generated supplier emails

🚨 The Signal: Dynamics 365 agents can now use custom scenarios for generating supplier emails. This introduces new avenues for prompt injection and data exfiltration risks via user-defined agent instructions.

The Impact

Procurement agents are affected, increasing the risk of data exposure and unauthorized communication due to custom agent instructions.

• Procurement Agents: Risk of generating inappropriate or unauthorized emails.
• Security Teams: Increased surface area for prompt injection attacks.
• Compliance Officers: Potential for non-compliant data handling in agent-generated content.
• Business Users: Risk of inadvertently exposing sensitive information through custom scenarios.

The Action

1. Review and implement strict prompt engineering guidelines for custom scenarios.
2. Establish an approval workflow for new custom agent scenarios and instructions.
3. Monitor agent-generated communications for anomalous content or data exfiltration attempts.
4. Educate users on secure prompt design and the risks of sensitive data exposure.
5. Implement data loss prevention (DLP) policies to scan agent-generated emails.

Domain: Agentic-AI · Impact: high · Workload: Other