Asking a person to approve sensitive actions is no longer a reliable safeguard for AI agents, according to new research from Microsoft. Its red team found poisoned agent memory can suppress or bypass those checks.
The finding is in the Microsoft Digital Defense Report 2026, produced by Microsoft Threat Intelligence. It covers July 2025 to June 2026 and draws on more than 165 trillion security signals Microsoft processes each day.
Australia ranked 11th among countries where Microsoft customers were most frequently affected by cyber threats between January and June 2026. It accounted for 1.5 per cent of impacted customers, against 25.5 per cent for the United States.
In Microsoft's regional sample of nation-state activity, Australia ranked fourth in Asia-Pacific with 27 observed events. Taiwan led the region with 193, ahead of Japan with 172 and India with 58.
The report says human-in-the-loop approval has become the default control whenever a new agent capability outpaces its classifiers. Agents are given the capability but told to ask the user before doing anything sensitive.
Microsoft's red team observed approval prompts being triggered but ignored by an agent. It also saw a policy stored in the agent's memory used to bypass approval within the same attack chain.
Memory poisoning drives the problem. Many agents can write to their own long-term memory. An attacker who places content anywhere the agent reads can therefore place content it will remember.
That content is then retrieved as trusted context in later sessions. Email is the most common delivery route, and a single poisoned entry can spread when memory is shared across tools, tenants or agents.
Agents Multiply the Attack Surface
Microsoft recommends separating trusted and untrusted write paths so untrusted data cannot write to a trusted memory store. It also advises treating the memory store as a high-value asset, with users able to audit individual entries.
Approval checks should be invoked deterministically by policy, so they cannot be bypassed by manipulating the model. They should also explain clearly what is being requested and why, and guard against approval fatigue.
Microsoft says 88 per cent of enterprises are already experimenting with AI agents. It reports 82 per cent of leaders plan broader rollouts within 12 to 18 months.
Of the attack prompts Microsoft observed against AI systems, 45 per cent sought malicious or policy-violating use. Another 17 per cent attempted sensitive data exfiltration and 14 per cent tried to leak system prompts.
The report says each agent needs its own identity rather than credentials borrowed from a human employee. Defenders should be able to inventory, attribute and revoke agent access at scale.
Identity remains the main target overall. User execution, valid accounts, social engineering and phishing made up 73.3 per cent of initial access attempts.
More than half of intrusions led to follow-on credential theft. Microsoft describes a self-reinforcing cycle in which one compromised identity fuels the compromise of many more.
Voice phishing through Microsoft Teams is succeeding despite external caller warnings. In the attacks studied, 93 per cent of attackers kept a target on the line for at least 20 seconds. That is long enough to begin a social engineering script.
Exposed container workloads are found and attacked quickly. The median time from container start to first exploit attempt was 5.3 hours, and more than half of compromised containers were exploited within 24 hours.
Microsoft urges organisations to reduce oversharing and apply sensitivity-aware, least-privilege access to data that AI systems and agents can reach. It also recommends reporting exposure reduced and time to mitigate, rather than the number of patches deployed.
Its 10 priorities for organisations include building a cryptographic inventory and advancing post-quantum planning alongside AI governance.