One malicious AI agent approval could open access to a company's Microsoft cloud environment. Attackers could then create additional agent identities using permissions granted through the original consent request.
Proofpoint disclosed BluePhishing on November 9, 2026, demonstrating how malicious Microsoft Entra agent blueprints can exploit legitimate consent requests to gain cloud access. Attackers can create agent identities and obtain tokens carrying approved permissions. Researchers have not observed the technique being exploited in the wild.
“Users are being conditioned to trust AI agents and grant them autonomy, but the security controls and awareness around those identities are still catching up,” said Yaniv Miron, director of threat research at Proofpoint.
Miron said BluePhishing shows how familiar phishing techniques can be adapted to AI agents, potentially turning one consent approval into hundreds of trusted identities inside an organization.
How BluePhishing creates agent identities
BluePhishing extends OAuth consent phishing, which tricks users into authorizing malicious applications without stealing passwords. The N0va device-code phishing campaign similarly abused legitimate Microsoft authentication, although through a different mechanism.
In its November 9 research disclosure, Proofpoint demonstrated how attackers could target Microsoft Entra Agent ID.
An attacker creates an agent blueprint in a tenant they control, configures its permissions, and sends a consent link to a target. Approval establishes a blueprint principal in the victim's tenant.
The principal receives AgentIdentity.CreateAsManager, allowing the attacker to create agent identities using the blueprint's credentials and a sponsor object ID from the victim tenant. These identities can obtain tokens carrying permissions configured for inheritance and granted through consent.
Administrator consent can authorize tenant-wide application permissions. Ordinary user consent is limited to permitted delegated access, which requires additional authentication to exercise through agent flows.
Proofpoint demonstrated access using User.Read.All and Group.Read.All, enabling Microsoft Graph queries for directory information. The attack does not automatically grant unrestricted administrative access.
Agent identity risks and defenses
One blueprint can support up to 250 agent identities. Microsoft's permission documentation confirms that approved permissions can extend to those identities when inheritance requirements are met. Inherited grants are not individually displayed in standard Entra administrative views.
These visibility limitations compound existing AI agent identity management challenges, particularly around ownership and access reviews. Microsoft has also introduced additional AI agent security controls, although some capabilities remain in preview.
Proofpoint cited a Microsoft announcement allowing default Entra users to create agent blueprints beginning in November 2026. Organizations should verify their tenant's rollout status and prioritize these safeguards:
- Restrict consent and creation: Review Entra consent policies and limit untrusted blueprint approvals and agent provisioning privileges.
- Audit identities and permissions: Assign owners, review blueprint principals and linked identities, and remove excessive access.
- Enforce least privilege: Limit application permissions and apply supported Conditional Access policies for agents.
- Monitor suspicious activity: Investigate unusual consent grants, agent creation, sign-ins, and token activity using related blueprint identifiers.
- Contain unauthorized access: Revoke malicious grants, disable affected blueprint principals, and investigate linked identities and tokens.
- Test incident response plans: Simulate malicious consent and unauthorized agent provisioning, including revocation and audit evidence preservation.
Although BluePhishing has not been observed in active attacks, its demonstrated ability to create agent identities through legitimate consent exposes a gap in cloud access governance. Organizations should ensure they can identify and revoke access across every identity associated with a suspicious blueprint.
Read more: Securing AI agents as API clients requires tightly scoped tokens, monitored API calls, and controls that limit misuse of authorized access.