i³ Threat Advisory: The Insider Attribution Paradox: Human vs. AI Agent Activity

Executive summary (TL;DR)

• This advisory examines the insider attribution problem: distinguishing human-directed activity from actions performed by AI agents.
• This matters because analysts increasingly need to determine not just who performed an activity, but whether the user directed it or an AI agent acted independently.
• Risk is highest for organizations running embedded AI agents in Microsoft 365.
• In this research, DTEX tests Microsoft Copilot and the Claude plugin for Microsoft 365 to understand what their telemetry reveals about human and agent activity.
• Four use cases ask: Do we see the agents? Where did the data go? Would we know if the agent was compromised? What can the agent do?
• The research shows how prompts, agent actions, file interactions, approval modes and data movement can be connected during an investigation.
• Key findings include agent actions occurring without human approval and data moving outside the tenant, highlighting gaps in attribution and visibility.
• Companies should prioritize linking prompts to agent actions and assessing visibility by use case.

Threat overview

Attributing AI agent activity means establishing whether a user directed what an agent did or the agent acted on its own.

DTEX raised this challenge in July 2025 in Uncovering the Top Risks of AI Agents and How to Mitigate Them, writing, “One of the key challenges is distinguishing between actions taken by human users and those initiated by AI agents.” It remains relevant because organizations still lack visibility into who performed an activity and exactly what was done. At DTEX, we believe user behavioral monitoring must answer whether a user directed the activity an AI agent performed or the agent acted on its own.

AI agent visibility remains essential for uncovering complex insider threats. That’s why this iTA presents research on detecting embedded AI agents in Microsoft 365 products such as PowerPoint and Word, with a specific focus on Microsoft Copilot and Claude plugins.

For an overview, see the quadrant chart showing how agents and humans overlap when working together.

DTEX investigation and indicators

From an analyst’s perspective, DTEX formerly used behavioral analytics to distinguish malicious from benign activity. Now analysts must also determine whether the activity was user-directed. If an AI agent acted without instruction from the process owner, investigators must identify what influenced the agent’s outcome.

The image above is a useful first pass, but it overlooks misconfigured agents and cases where the agent follows acceptable use while the user’s intent is malicious.

DTEX’s research uncovers signals that feed the unified enterprise telemetry’s observations and indicators. While DTEX designs these indicators to simplify analysts’ work, understanding the raw data aids subtle, complex investigations and lets analysts report with greater confidence.

Use cases

We examine four use cases in this iTA, each answering a question analysts commonly face. We focus on Microsoft Copilot, whose actions appear in Microsoft logs and are collected via the integrations framework introduced in AI Agent Access Control Without Entitlement. The other assistant is the Claude plugin for Microsoft 365 apps, whose visibility comes from OpenTelemetry (OTel). This experimental feature shows the types of logs to expect from these enterprise tools.

The use-case questions and indicators we discuss are:

1. Do we see the agents?
2. Where did the data go?
3. Would we know if the agent was compromised?
4. What can the agent do?

In all use cases, both the Microsoft Copilot and Claude plugin agents were given a similar task to perform.

Signals

Do we see the agents?

When an employee uses an AI agent within a spreadsheet, does DTEX see it? Can the data identify the agent’s owner account, and which agent performed the activity?

The task was to summarize revenue and valuation assumptions, then add a year-over-year variance column within a confidential finance Excel spreadsheet.

The examples above show clear differences between Microsoft Copilot integrations and the Claude plugin via OTel. In the Copilot chat records, Activity_User_Name on a response names the assistant (e.g., “Copilot in Excel”), while prompts carry the human username, and Chat_Id links the two. For the Claude plugin, the activity is subtler, as shown below.

Each action the Claude agent takes records its own approval decision in Ai_Agent_Approval_Mode (auto_accept, manual or deferred) and Ai_Agent_Auto_Approved. Here, the file reads and edits were auto-accepted, so no human confirmed them, and Chat_Id ties each action back to the prompt that started it.

In both examples, the DTEX activity documents provide summaries that help an analyst understand what happened.

Where did the data go?

A user built a five-slide investor deck from two confidential workbooks, then — via a tenant-built Salesforce declarative agent (custom agent) and its MCP connector — pulled CRM records and drafted an external email with the confidential deck attached.

First, we step through the example with Microsoft Copilot.

As in the first use case, Activity_User_Name helps delineate human versus agentic activity. The conversation links with the same Chat_Id.

We then see the Copilot agent interact with the tenant-built declarative agent; the last column shows this is a custom agent. From the previous iTA, we know such an agent can be misconfigured to expose more information than intended. In this use case, we assume the agent is configured correctly.

Finally, the user asks the agent to draft an email to a personal address. This is carried out through a custom agent that interacts with Outlook.

These activity signals clearly show what happened, which files were touched and whether actions were human-directed. Previously, DTEX could piece this together from HIF and process activity. These signals are higher quality for Observations and Indicators and enable a faster response to insider threats.

The Claude task is similar. To show tracking ability, we illustrate the flow of data from a confidential spreadsheet into a PowerPoint presentation.

Activity_Summary will help analysts most here as a low-level DTEX observation. Chat_Mode and Ai_Agent_Approval_Mode also help determine human versus agentic behavior.

In the second step, we see file interactions via Activity_Type and can follow the interaction steps using Activity_Context or Activity_Summary.

Would we know if the agent was compromised?

Good news! Across every run, neither Microsoft Copilot nor the Claude plugin acted on the hidden instructions. They summarized the document and ignored the planted commands. That is the outcome you want. The security question this scenario answers is: if an agent had been hijacked, would DTEX show it? The captured fields say yes. They are the same fields that confirm the refusal here.

In sensitive documents, we hid reviewer notes in comments telling the assistant to consult unrelated confidential workbooks and include their contents in the output. Then we asked each agent to summarize the document. This is indirect prompt injection: the user prompt appears benign, but the malicious instruction hides in the content.

In the Microsoft Copilot case above, both Ai_Agent_Prompt_Injection_Detected and Ai_Agent_Jailbreak_Detected reported false. These reports come from the integrations. We should not assume these safeguards are perfect, so we verify access via DTEX. Neither injection target appears in Ai_Agent_Accessed_Resources, and the classifier did not fire, so the model itself ignored the instruction. Where the prospectus was attached, the agent’s resources were limited to that document.

The Claude plugin logs less verbosely than the Microsoft Copilot example, so this relies on DTEX’s visibility into user and agent file interactions. To see the exact path and file, filter by the values in the activity document below.

What can the agent do?

The final question highlights two capabilities that are easy to miss and hard to govern: running code outside the tenant, and agents acting for other agents with no human in the loop. In these examples, the agents aren’t misconfigured, so the activity is permitted by the organization. The Python ran as a server-side tool, for which the telemetry records no approval decision, i.e., the user was not asked. The handoffs between agents were auto-accepted.

In the Claude example, Ai_Agent_Approval_Mode is server_tool_no_prompt, a specific label assigned to server-side tools that ran with no approval decision recorded. The Claude Excel agent ran Python in Anthropic’s sandbox and loaded both confidential workbooks. The agent uploaded both workbooks to Anthropic’s environment (FileUploaded) and then ran Python over the copies; the code in Process_Parameters names the files. The uploads, not the code, are when whole-file copies left the tenant.

Another notable feature is agent-to-agent delegation, visible through Ai_Agent_Target_Name and Ai_Agent_Parent_Id. Each handoff (send_message) was auto-accepted, and the receiving agent acted with no human prompt.

Here, we filtered a subset of activities to show how Microsoft Copilot presents the same information differently. The Copilot agent invoked custom agents (Outlook and Salesforce) to assist based on the user’s initial prompt.

Different AI tools mean different visibility

For Microsoft Copilot, we see only what the native cloud logging exposes through our integrations, which limits our visibility. For the Claude plugin, OTel adds a separate activity stream covering actions the endpoint agent cannot see. Neither solution is perfect, but as organizations adopt these enterprise tools across workflows, discovering these signals becomes critical.

Tie-in to indicators and AI Risk Management AI threat hunts

Analysts can use these signals to correlate activity from user prompt to agent actions and integrate them into custom categories and rules across products. For AIRM users, the Microsoft Copilot fields are already discoverable in existing rules and categories; the Claude OTel signals are experimental and not yet in product. The signals can also feed AIRM AI Threat Hunts to produce detailed investigation summaries from robust data. Instead of analysts manually linking identity, entitlement and audit data after an alert, the platform will evaluate those relationships during detection.

This change lets integrations and OTel provide more than investigative context. By combining audit activity with user identity and entitlement data, AIRM can determine who initiated a query, check whether returned information matches the user’s authorized access, and spot when an AI system grants access beyond the user’s normal permissions. Entitlement drift becomes a detectable risk condition rather than a manual find.

Mitigations: what organizations should do now

AI behavioral monitoring

We spent much of this year discussing AI visibility. At first, we focused on which agents were used to spot shadow AI. That quickly shifted to tracking actions by approved corporate agentic AI. The vulnerabilities existed before AI, but organizations now must stitch events together to uncover potential incidents.

The first step is gaining visibility into each use case and the nuances of each tool. At DTEX, we know this isn’t a task for our forwarder alone. File and process activity logs, HTTP inspection, integrations and OpenTelemetry all provide valuable data.

Insider threat analysts now try to answer:

• Did a human or an agent perform the action?
• Which files contributed to the outcome?
• Where did the data flow?

Assessing visibility by use case lets organizations determine whether their current visibility is sufficient.

Investigation support

This advisory includes limited-distribution reporting available only to approved insider risk practitioners. To request access to the redacted material, log in to the customer portal or contact DTEX i³.

For organizations assessing suspected related activity, DTEX i³ can provide additional intelligence, indicator support, and investigative guidance. Behavioral detections should be tested and tuned prior to enterprise-wide deployment, particularly in large environments where scale can affect signal quality and operational effectiveness.

Sources

• Uncovering the Top Risks of AI Agents and How to Mitigate Them
• AI Agent Access Control Without Entitlement