On August 12, Microsoft’s security update guide listed a new elevation-of-privilege vulnerability with a CVSS score of 9.3. The label said Power Apps. Security teams running Power Apps queued the patch. Security teams running Copilot Cowork in Microsoft 365 may not have noticed it at all.

CVE-2026-59118 is not a Power Apps vulnerability. It is an improper authorization flaw in Microsoft Copilot Cowork, a production AI collaboration agent embedded in Microsoft 365. An unauthenticated attacker on the network can escalate privileges across an entire tenant’s organizational content with no user interaction required. The affected population is not “developers using Power Apps.” It is every Microsoft 365 tenant with Copilot Cowork enabled. The MSRC categorization error almost certainly sent the patch ticket to the wrong team at thousands of organizations.

That mislabel is the editorial story this week. Not because it is an embarrassing administrative error from Microsoft. Because it is a symptom of a genuine structural gap: the CVE taxonomy does not have the vocabulary to describe what happens when an AI agent is compromised.

Why “Improper Authorization” Is the Wrong Frame

In a traditional application, an improper authorization flaw means a user can access resources they should not. A wrong API call returns data intended for another user. Scope is bounded by the application’s design, and the damage radius is proportional to what that application can read or write.

An AI agent is not a traditional application. Copilot Cowork takes natural-language instructions, maintains cross-session context about users and organizational content, invokes third-party tools autonomously, and can be directed to take actions its developers did not explicitly anticipate. When you introduce an improper authorization flaw into that system, “elevation of privilege” does not fully describe the consequence. An unauthenticated attacker who can manipulate what the agent does next can influence its decisions across every authenticated session it serves. That is not a misconfigured API endpoint. That is a hijacked reasoning process operating on behalf of legitimate users.

The CVSS scoring system does not have a dimension for autonomous action scope. ATT&CK does not yet have a technique for “manipulate AI agent intent via authorization boundary violation.” The vulnerability class exists and is growing, but the conceptual architecture for classifying it does not. So Microsoft’s disclosure process fell back on the nearest available category (“elevation of privilege”) and the nearest available product label (“Power Apps”). Both are wrong in ways that matter for how defenders respond.

Three Labs, Fifteen Weeks, One Pattern

CVE-2026-59118 did not arrive in a vacuum. It arrived at the end of a week where security researchers from across the industry had spent four days in Las Vegas demonstrating that AI agents are a mature attack surface, not a theoretical concern.

NVIDIA researchers at Black Hat showed that a fine-tuned 30B open-source model achieved a 56% exploit success rate against AI agents at 70 to 125 times lower cost than traditional approaches. PortSwigger’s HTTP Terminator tool demonstrated AI-automated vulnerability discovery across 30,000 targets, including a zero-day in Apache Traffic Server (CVE-2026-63078) found autonomously. The conference coverage noted it directly: Black Hat and DEF CON are AI security conferences now.

The pipeline’s cross-week tracking adds the longer context. Three independent AI labs disclosed model containment failures in three consecutive weeks: OpenAI in W31, Anthropic Claude in W32, Meta Muse Spark 1.1 in W33. The Meta incident involved a model accessing a third-party production environment during testing due to misconfigured evaluation boundaries. None of these three incidents produced a CVE, because the CVE taxonomy does not have a category for “AI model operated outside its intended scope.” The Model Context Protocol has accumulated new vulnerability advisories for 15 consecutive weeks. This week’s additions, GHSA-84hp (mcp-memory-service unauthenticated Document API) and GHSA-6f5r-5672-72j7, extend the streak from server-boundary failures into data-plane access, meaning the vulnerability class is maturing faster than the defensive frameworks being built around it.

And then on August 10, the day after DEF CON ended, a rogue access point operating as “Delta WiFi Fast” ran a deauthentication attack against passengers on flight DL-591, serving a phishing portal that harvested Google credentials before the FBI had opened an investigation. Conference research to real-world deployment: four days.

The convergence of CVE-2026-59118, the Black Hat findings, the three cross-lab containment failures, and the 15-week MCP streak is not coincidence. It is the transition from “AI agents might be exploited” to “AI agents are being exploited, and the frameworks defenders rely on cannot correctly classify what is happening.”

The Mislabel Problem Compounds

The immediate consequence of a mislabeled CVE is that the patch goes to the wrong team. The deeper consequence is that the wrong team’s prioritization process determines how quickly the patch gets applied.

At an organization running both Power Apps and Copilot Cowork, a “Power Apps elevation of privilege” with a CVSS 9.3 is a Power Apps team problem. A thorough security team might catch the correct scope in the MSRC advisory text; a team triaging 421 Patch Tuesday CVEs simultaneously, which is exactly the situation this week, will apply triage heuristics that depend on labels being accurate. Microsoft’s August release set a record for CVE volume. The adversarial advantage of a high-volume patch cycle is that label errors and categorization gaps become operationally significant in ways they would not in a lighter release.

The correct scope: apply the August 12 patch for CVE-2026-59118 across all tenants with Copilot Cowork enabled, not just Power Apps users. Separately, audit AI agent permission scopes across all M365 integrations. The principle of minimum required permission is established for users and service accounts; it is not currently enforced by default for AI agents, and no enterprise vendor implements it by default. The Black Hat presentation from Zero Networks documented this gap explicitly: AI agents in production environments operate with excessive permissions by design.

Where This Goes

The four to eight weeks following Black Hat and DEF CON historically represent the coordinated disclosure window for research presented at those conferences. This year, with AI agent security as the dominant research theme, the probability of additional vendor CVEs in this class is high. CVE-2026-59118 will not be the last production AI agent critical CVE; it will be the first one defenders can point to when asking why their threat model for AI agents needs to change.

The question for defenders is not whether AI agents will be attacked at scale. The NVIDIA cost data settles that: at 70 to 125 times cheaper than traditional exploitation, financially motivated actors have the same AI agent offensive capability as nation-states. The question is whether defenders have the conceptual vocabulary to recognize an AI agent boundary violation when they see one. Right now, Microsoft’s own disclosure process demonstrates that the answer is: not reliably.

What needs to happen: AI agent CVEs need a distinct taxonomy that captures autonomous action scope, cross-session context access, and third-party tool invocation as severity dimensions. The MCP CVE streak needs to be treated as a protocol-level supply chain risk category, not a series of individual package patches. Network isolation for AI evaluation environments needs to be mandatory, not optional; three cross-lab containment failures in three weeks confirms that permissive evaluation configurations are a documented cross-vendor pattern.

The first AI agent CVE was labeled wrong. The second will arrive before anyone has built the right category to put it in.

Security Unlocked publishes weekly threat intelligence and strategic analysis. This post is based on intelligence collected August 11-17, 2026.