Copilot Firewall

The surface

Copilot on the endpoint

Four Copilots, four different agent runtimes — most of them acting on files and systems, not just drafting text.

Office agent

M365 Copilot — Agent Mode

Now the default Copilot experience in Word, Excel, and PowerPoint: multi-step autonomous edits, restructures, and rebuilds across documents — inheriting the user's full Graph permissions.

OS agent

Copilot on Windows

Copilot Actions operates on local files (Documents, Downloads, Desktop, and beyond) in a separate "agent workspace" running under its own agent account.

Coding agent

GitHub Copilot — agent mode

Autonomous multi-file edits plus terminal command execution with user privileges in VS Code, Visual Studio, and JetBrains; a cloud coding agent turns Issues into PRs unattended.

Low-code agents

Copilot Studio

Any business user can build and publish agents with real permissions — connectors, MCP servers, and write access to external systems, often without IT ever seeing them.

Where the risk lives

The tenant boundary is not the device boundary

Attack surface

Graph oversharing — Copilot sees everything the user can; studies put hundreds of thousands of overshared files in the average org within its reach.
MCP in the IDE — arbitrary third-party MCP servers wired into VS Code and via .github/copilot-mcp.json, with no payload inspection.
Shadow Studio agents — bundled licenses mean agent creation outpaces IT tracking; overprivileged "double agents" persist after their creators move on.
Auto-approve configs — popular "YOLO" settings let agent mode run commands without confirmation.
Personal GitHub accounts — Copilot policy binds to org membership, not the device; a personal login sidesteps every enterprise policy.

Documented in the wild

EchoLeak (CVE-2025-32711) — zero-click prompt injection: one crafted email exfiltrated M365 data past Microsoft's classifiers with no user interaction. Patched; the injection class persists.
Copilot RCE (CVE-2025-53773) — prompt injection flipped GitHub Copilot into auto-approve mode by writing settings.json, achieving code execution.
Top-10 Studio risks — Microsoft's own security team published a top-10 risk list for Copilot Studio agents and an OWASP agentic-AI mapping.

Native controls govern inside the Microsoft boundary. Purview, the Copilot Control System, and Agent 365 are tenant-side: they can't see a personal Copilot login, what an agent-mode terminal command actually did to the filesystem, or the third-party MCP servers a developer wired into their IDE. Enforcement lands after the action — Ospiri sits where the action lands.

Admin plane integration

We plug into your Microsoft admin plane

Ospiri connects to the Copilot Control System, Purview, and GitHub's Copilot APIs — and correlates tenant-side records with device-side reality.

What Microsoft's admin plane exposes

Copilot Control System (M365 admin center) — licensing, Copilot settings, and the Agent 365 Agent Registry: tenant-wide inventory and lifecycle for Copilot Studio, pro-code, and third-party agents.
Purview Audit — CopilotInteraction and third-party AIAppInteraction records, searchable and exportable via the Office 365 Management Activity API; DSPM for AI posture reports.
Graph usage reports — per-user, per-app Copilot usage for licensed users.
GitHub Copilot APIs — org/enterprise metrics, seat and billing management, policy enforcement.

What Ospiri does with it

Ingest & correlate — Purview interaction records and Agent Registry inventory are joined with kernel telemetry: the audit log says Copilot acted; Ospiri shows which files, processes, and domains.
Close the tenant boundary — personal GitHub logins, unlicensed users, and third-party MCP servers never appear in Purview; Ospiri reconciles device reality against the registry.
Push policy back — findings feed agent blocking in CCS and GitHub org policies, so response lands in both planes.

Endpoint or cloud — same firewall. Coverage applies whether the agent runs in an IDE on a laptop, in Windows' agent workspace, or as a cloud coding agent / Azure-deployed agent: admin-plane signals in, runtime control at the point of action.

The fix

How Ospiri governs Copilot

Visibility

Fleet-wide inventory of every Copilot runtime — Office agent mode, Windows Copilot Actions, IDE agents, Studio agents reaching the device. Personal vs. enterprise account detection that tenant policy can't do.

Sandboxing

Kernel-level fences around what agent-mode terminal commands and Copilot Actions can touch: production paths, secrets, and regulated data. Risky writes land in a sandbox copy — workflow unbroken.

Anomalies

Per-agent baselines across endpoint, browser, and identity catch EchoLeak-style egress and the Studio agent that suddenly reads what it never read before.

Skills

Scan agent instructions, declarative-agent manifests, and repo config files (settings.json, .github/) for injected instructions before they execute — the CVE-2025-53773 class, blocked pre-flight.

MCP

Discover every MCP server configured in IDEs and Studio agents, inspect tool-call traffic, and enforce per-agent allow-lists — every call logged and replayable for audit.

The Copilot Firewall