Copilot Agents Gain Real-Time Defender Checks

Microsoft Defender researchers describe webhook-based runtime inspections that monitor Microsoft Copilot Studio agents' tool invocations in real time to detect and block malicious or unintended actions. Defender evaluates invocation context, intent, and orchestration outputs before allowing execution, enabling security teams to stop prompt-injection exfiltration and enforce policies without altering agents' internal logic.