What happened
Proofpoint disclosed a research-based proof-of-concept (reported to Microsoft on Nov 9, 2026, surfaced Nov 11) that abuses Entra Agent ID's consent flow for AI agents. By tricking a user into approving a third-party agent blueprint, the attacker obtains a non-revocable AgentIdentity.CreateAsManager permission and can mint agent identities inside the victim tenant with broad Graph permissions (User.Read.All, Group.Read.All), because consent controls and permission visibility for agents are less mature than for apps and inherited permissions only appear inside tokens at runtime. Proofpoint has not observed real-world use yet.
Why it matters
As AI agents get their own identities in enterprise tenants, the attack surface shifts to agent consent and blueprints. This is a novel agent-identity attack class: it bypasses password and MFA, survives password resets via a long-lived agent principal, and scales to hundreds of agent identities per blueprint, with activity that defenders may overlook because agents acting autonomously 'look normal.' It directly threatens AI-agent deployments that use Microsoft Entra Agent ID for model/agent identity.
Attack vector
An attacker registers an agent blueprint in a tenant they control, sets the sign-in audience to allow other organizations (not visible in the Entra portal), attaches broad permissions, and sends a victim an OAuth consent link. When the victim approves, a blueprint principal is created in the victim's tenant with the implicit, non-revocable AgentIdentity.CreateAsManager permission; the attacker can then request a Graph token and create agent identities (up to 250) inside the tenant, which can be loaded into GraphRunner-style tooling to run Graph requests with the agent's permissions. No password is stolen and no login screen is faked.
Affected systems
Microsoft Entra Agent ID (agent blueprints / blueprint principals / agent identities) — identity model for AI agents in Microsoft 365; no product patch, a controls gap. Proofpoint report published Nov 9, 2026 and covered Nov 11; Microsoft 365 Message Center MC1506733 makes agent-blueprint creation a default user permission from November 2026.
Mitigation
Proofpoint recommendation: extend existing user-consent limits to agent blueprints and agent identities, use permission classifications, enforce least privilege and Conditional Access for agents, and monitor audit logs ('Add application' = blueprint created, 'Add service principal' = agent identity created). Microsoft blocks some risky Graph permissions for agents; treat the AgentIdentity.CreateAsManager implicit permission and the blueprint ID in every tenant as an indicator of compromise.