MT.1116: AI agents should not send email with AI-controlled inputs.
| ID | MT.1116 |
| Severity | High |
| Suite | Mito |
| Product | Copilot Studio |
| Feature | Agents |
| Security area | AI and agents |
| Resource type | Agent |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-4 Information Flow Enforcement |
| MITRE ATT&CK | T1048 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”AI agents should not send email with AI-controlled inputs.
Agents configured with email-sending tools (such as Office 365 Outlook connectors) where the recipient, subject, or body can be influenced by AI-generated content present a data exfiltration risk. An attacker could craft prompts that cause the agent to send sensitive organizational data to external addresses.
How to fix
Section titled “How to fix”Remove email-sending tools from agents that do not have a legitimate business need to send email. For agents that do require email capabilities, ensure recipients are restricted to a fixed list and are not dynamically determined by user input or AI-generated content. Use DLP policies to block the Outlook connector for agents that should not send email.
Learn more: Configure data policies for agents
Mito check. Author: lnfernux. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.