New 'BluePhishing' scam sees criminals spoof AI agents to get access to corporate environments
Be careful which agents you approve
by https://www.techradar.com/author/sead-fadilpai · TechRadarNews By Sead Fadilpašić Published 10 November 2026
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter
- Researchers showed Microsoft Entra Agent ID blueprints can be abused to socially engineer malicious AI agents into organizations
- A single approved blueprint can spawn hundreds of agent identities with access to corporate resources
- Defenders should restrict third-party agent consent, apply least-privilege controls, and monitor agent creation events
When Microsoft first introduced Entra Agent ID as a way organizations can identify and monitor AI agents, it most certainly did not think it would be used to smuggle malicious agents into corporate environments. Yet, that’s where we are today.
Entra Agent ID is an extension of Microsoft Entra. It’s a system that allows companies to create AI agents, give them digital identities, and then decide which services and what data they can access. Expecting organizations to deploy dozens (if not hundreds) of these agents, Microsoft also introduced “agent blueprints”, essentially templates companies can use to create multiple AI agent identities, each with their own permissions.
In a new report, security researchers Proofpoint laid out how a threat actor could create a malicious blueprint in their own Microsoft environment and then - using classic social engineering techniques - convince a victim to approve it in their own environment. To make matters worse, when a malicious agent enters the environment, they can “clone” themselves, creating multiple additional identities, all tasked with doing different things.
Latest Videos FromTechRadarWatch full video here:
How the attack plays out
Proofpoint found the attack starts with the attacker setting up a blueprint in a Microsoft Entra environment they control. They can configure its credentials and the permissions they want it to receive and also make sure it can be authorized by other organizations.
Then, they create a link that leads to a genuine Microsoft authorization page. Unlike your run-of-the-mill phishing attack, this one is different because the login page doesn’t need to be fake and spoofed. The attacker does, however, need to have some basic information about the target organization, such as their tenant ID and details about an existing user they can specifically target.
Then comes the fun part: the victim is presented with the link (this can be done via email, social networks, instant messaging platforms) which asks them to approve the blueprint and its permissions. The link is legitimate, and so is the popup prompting the approval - nothing suggests this is actually a highly sophisticated phishing scam.
If they click the link and approve the blueprint, the malicious AI is added inside their organization.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors