CIA Brief 20260726

CIA Brief – Weekly News Digest

Here’s a quick roundup of the Microsoft, security and AI news worth tracking this week. As always, I’ve skipped the noise and focused on what actually matters for MSPs and SMBs.

Announcements & Product Launches

Claude Opus 5 is available today in Microsoft Foundry

Anthropic’s Claude Opus 5 — the first model in the fifth generation of Claude — is now available in Microsoft Foundry. Microsoft positions it for enterprise agents and long-running, complex work: it can run for hours, navigate large codebases like a senior engineer, reason over documents and visuals, and automate multi-step tasks across applications. Paired with Foundry’s governance, security and evaluation tools, teams can build and run production AI agents.

https://techcommunity.microsoft.com/blog/azure-ai-foundry-blog/claude-opus-5-is-available-today-in-microsoft-foundry/4535068

Introducing MAI-Image-2.5-Pro and MAI-Voice-2-Flash

Microsoft AI has released two new in-house models in public preview: MAI-Image-2.5-Pro, its highest-fidelity image model with notably accurate in-image text rendering, and MAI-Voice-2-Flash, a faster, cheaper speech model (about 2× faster and ~32% cheaper than MAI-Voice-2). The models are already powering production features in Bing Image Creator, PowerPoint, OneDrive and Dynamics 365 Contact Center. Both are available to build with in Microsoft Foundry.

https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/

Microsoft and Mistral expand strategic partnership

Microsoft and Mistral have significantly expanded their partnership, including a multibillion-dollar deal for Microsoft to tap Mistral’s growing GPU capacity in Europe. Mistral’s Medium 3.5 and OCR 4 models are now in Microsoft Foundry, with Medium 3.5 also in Copilot Studio. The aim is to give enterprises and regulated industries frontier AI they can run across cloud, cloud-connected and fully disconnected environments while keeping control of their data.

https://news.microsoft.com/source/2026/07/21/microsoft-and-mistral-expand-strategic-partnership-to-give-enterprises-and-regulated-industries-frontier-ai-they-can-control/

Policy & Industry Perspective

Open Weights and American AI Leadership

In this Microsoft corporate-responsibility piece, Microsoft argues that America’s AI leadership depends on building a strong, open ecosystem rather than a single frontier model. It makes the case for open-weight models — which anyone can download, inspect, modify and run — as a way to widen access, boost competition, give customers control, and even improve security. The statement is co-signed by a long list of technology and AI companies, including Microsoft, NVIDIA, OpenAI, Meta, Google, Hugging Face and Mistral.

https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/

Industry News

How worried should we be about the AI that went rogue and launched a cyber-attack?

A BBC News video examining a reported case of an AI system being used to carry out a cyber-attack, and asking how concerned we should be about AI-driven security threats. Shared as a video in the AI team’s Models channel.

https://www.youtube.com/watch?v=M4kliMrqbB4

OpenAI Says Its Models Hacked Hugging Face by Mistake

A Bloomberg Television segment reporting that OpenAI said its models hacked Hugging Face “by mistake.” The clip covers the incident and what it suggests about AI safety and autonomous model behaviour.

https://www.youtube.com/watch?v=rN_7QlYg_b8

Chinese AI Model Raises Pressure on US Spending

A Bloomberg Television segment on a new Chinese AI model and how it is intensifying pressure on US AI investment and spending. It looks at the competitive dynamics between Chinese and US AI development.

https://www.youtube.com/watch?v=8v5T7Gk0_b8

Tools & Resources

How to create custom skills (Claude)

A Claude help-centre guide explaining how to create custom “skills” — reusable packages of instructions (and optionally scripts) that give Claude specialised knowledge for specific, repeatable tasks. It covers recording a skill by demonstrating a workflow on a Mac, the required skill.md structure, and packaging, testing and best practices.

https://support.claude.com/en/articles/12512198-how-to-create-custom-skills

The Agent Skills Directory (skills.sh)

Skills.sh is an open directory of reusable “skills” for AI agents that can be installed with a single command to add procedural knowledge. It lists and ranks community and official skills — from the likes of Anthropic, Vercel and Microsoft — across topics such as design, testing and agent workflows, and works with agents including Claude Code, Cursor and GitHub Copilot.

https://www.skills.sh/

As always, the challenge isn’t finding information — it’s focusing on what actually matters.

After hours

SpaceX launches Starship on 13th flight test, booster splashes down – https://www.youtube.com/watch?v=2TF98WKebD4

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260711

Security

Defending the Inbox Against Prompt Injection Attacks
Microsoft is adding prompt-injection protection to Defender for Office 365, targeting attacks that try to hijack AI assistants through poisoned email content. As clients switch on Copilot and email-reading agents, the inbox becomes an attack surface for the AI, not just the human. Still early, but worth understanding now so you’ve got an answer when a client asks.
https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/defending-the-inbox-against-prompt-injection-attacks/4534636

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Microsoft’s threat researchers break down GigaWiper, a destructive backdoor stitched together from several malware families. Wipers don’t steal — they destroy — so this is a good reminder that tested, offline backups are the last line of defence for SMB clients. Read it to understand the tactics before you’re explaining them to a customer mid-incident.
https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/

Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
Microsoft walks through how its Secure Future Initiative is hardening its own cloud proactively rather than reactively. Not much you action directly, but it’s useful reference material for the “is Microsoft actually secure?” conversation with nervous SMB owners. Nothing groundbreaking, but decent ammunition for trust discussions.
https://www.microsoft.com/en-us/security/blog/2026/07/08/protecting-microsoft-at-ai-speed-how-sfi-proactively-hardens-our-cloud/

5 insights from Frost & Sullivan’s 2025 Frost Radar for Cloud Security Posture Management
Microsoft’s been recognised in Frost & Sullivan’s latest Frost Radar for Cloud Security Posture Management. The takeaway for MSPs isn’t the ranking — it’s that CSPM is now table stakes for anyone running client workloads across cloud. Worth a look if you’re still treating posture management as a nice-to-have.
https://www.microsoft.com/en-us/security/blog/2026/07/06/5-insights-from-frost-sullivans-2025-frost-radar-for-cloud-security-posture-management/

Microsoft 365 & Windows

Cross-Tenant Message Recall in Exchange Online
Exchange Online is gaining cross-tenant message recall, letting senders pull back emails delivered to recipients in other tenants. For MSPs juggling multiple client tenants and the occasional reply-all disaster, this is genuinely useful damage control. Good reminder to confirm it’s supported before you promise a client you can un-send something.
https://techcommunity.microsoft.com/blog/exchange/cross-tenant-message-recall-in-exchange-online/4535800

Admins: Migrating user data during mergers and restructurings just got easier
Microsoft has streamlined migrating user data during mergers and restructurings — exactly the work MSPs get dragged into. If you handle M&A or org changes for clients, this could save real hours on mailbox and data moves. Worth a look before your next tenant consolidation.
https://techcommunity.microsoft.com/blog/microsoft365insiderblog/admins-migrating-user-data-during-mergers-and-restructurings-just-got-easier/4530703

Cloud & AI

What’s new in Agent 365 – June 2026
Microsoft’s monthly rundown of what’s changed in Agent 365, its platform for managing AI agents across the org. As clients spin up more agents, someone has to govern, secure and inventory them — and that someone is usually the MSP. Worth tracking so agent sprawl doesn’t blindside you later.
https://techcommunity.microsoft.com/blog/agent-365-blog/whats-new-in-agent-365-%E2%80%93-june-2026/4535107

Available today: OpenAI’s GPT-5.6 in Microsoft 365 Copilot
OpenAI’s GPT-5.6 is now live inside Microsoft 365 Copilot. For clients already paying for Copilot, this is a free capability bump — nothing to deploy, but a good excuse to check in and show them what’s improved. Handy to know when they ask which model they’re actually running.
https://techcommunity.microsoft.com/blog/microsoft365copilotblog/available-today-openai%E2%80%99s-gpt-5-6-in-microsoft-365-copilot/4533152

Built for Business: How Microsoft 365 Copilot Connects the Tools That Power Your Business
Microsoft is pushing how M365 Copilot connects to the other tools clients actually run — CRM, finance, line-of-business apps — through connectors. This is where Copilot starts earning its keep for SMBs beyond summarising emails. Worth a look if you’re trying to justify the Copilot spend to a sceptical client.
https://techcommunity.microsoft.com/blog/microsoft_365blog/built-for-business-how-microsoft-365-copilot-connects-the-tools-that-power-your-/4534980

How Commonwealth Bank and Microsoft are reimagining the future of customer service
A customer story on how CommBank is using Microsoft AI to rework customer service at scale. Enterprise-sized and not directly SMB-relevant, but the patterns — AI triage, agent-assisted support — are exactly what smaller clients will ask you to replicate on a budget. Good reminder of where the puck is heading.
https://news.microsoft.com/source/asia/features/how-commonwealth-bank-and-microsoft-are-reimagining-the-future-of-customer-service

As always, the challenge isn’t finding information — it’s focusing on what actually matters.

After hours

Half Life web port – https://hl2.slqnt.dev/

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260627

Security & Threat Intelligence

One intrusion, two cyberattackers: Uncovering parallel threat activity
A good reminder that compromises are no longer single-actor events. This research shows how multiple threat actors can exploit the same breach simultaneously, reinforcing the need for layered visibility and rapid response.
https://www.microsoft.com/en-us/security/blog/2026/06/22/one-intrusion-two-cyberattackers-uncovering-parallel-threat-activity/
StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
Breakdown of two common infostealers and how they’re packaged and distributed via cybercrime-as-a-service models. Useful insight into how attackers are scaling credential theft.
https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
AutoJack: How a single page can RCE the host running your AI agent
Highlights a potential remote code execution path via AI agents. Worth understanding as more organisations start deploying AI-driven workflows.
https://www.microsoft.com/en-us/security/blog/2026/06/18/autojack-single-page-rce-host-running-ai-agent/
Five Eyes Cyber Security Agencies Statement
Joint statement from international cybersecurity agencies outlining shared priorities and the need for coordinated defence against evolving global threats.
https://www.cisa.gov/news-events/news/five-eyes-cyber-security-agencies-statement
Scaling cybercrime disruption through innovation and AI
Microsoft outlines how AI and collaboration are being used to disrupt cybercrime infrastructure, with a focus on proactively scaling defence capability.
https://blogs.microsoft.com/on-the-issues/2026/06/24/scaling-cybercrime-disruption-through-innovation-and-ai/

Microsoft Product Updates & Announcements

Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms
Microsoft continues to rank strongly in endpoint management, with strengths across device management, security, and integration across its ecosystem.
https://www.microsoft.com/en-us/security/blog/2026/06/25/microsoft-a-leader-in-the-forrester-wave-for-endpoint-management-platforms/
Point-in-time restore for Windows 11 is now generally available
New capability allowing systems to be rolled back to a known good state. This is a practical addition for resilience and incident recovery.
https://techcommunity.microsoft.com/blog/windows-itpro-blog/point-in-time-restore-for-windows-11-is-now-generally-available/4508101
What’s new in Microsoft Intune – June
Monthly update outlining the latest Intune features and improvements that enhance device management and security posture.
https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-%E2%80%93-june/4491983
Microsoft 365 Insider Round-Up: June 2026
A consolidated overview of recent Microsoft 365 updates, providing a quick way to stay across platform changes.
https://www.linkedin.com/pulse/microsoft-365-insider-round-up-june-2026-microsoft-365-insider-qz1be/

Cloud & AI

Rethinking cloud operations with agentic observability
Explores how AI-driven observability is helping shift cloud operations from reactive monitoring to more autonomous approaches.
https://blogs.microsoft.com/blog/2026/06/23/rethinking-cloud-operations-with-agentic-observability/

Sustainability

Inside Microsoft’s two-decade push to cut water intensity while scaling for growth
Details Microsoft’s long-term efforts to reduce water consumption while continuing to expand infrastructure globally.
https://blogs.microsoft.com/blog/2026/06/24/inside-microsofts-two-decade-push-to-cut-water-intensity-while-scaling-for-growth/

After hours

When a cyber attack took 100 hospitals offline – https://www.youtube.com/watch?v=WxY6aLRVgcI

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260620

Copilot — Cowork general availability

Copilot Cowork is now generally available

Copilot Cowork has moved out of preview and is now generally available. It lets users build agents and skills that automate repetitive, multi-step work across Microsoft 365 — drafting content, producing reports, triaging tickets and more — bringing autonomous task handling to everyday users.

Security — AI agent threats

AutoJack: How a single page can RCE the host running your AI agent

Microsoft’s Security team breaks down “AutoJack,” a technique where a single malicious web page can achieve remote code execution on the machine hosting an AI agent. It’s a clear illustration of the new attack surface that autonomous agents create when they browse and act on untrusted web content.

Security — Email protection

Microsoft Defender email security benchmarking: Key insights from one year of data

Drawing on a full year of benchmarking data, Microsoft shares what it’s learned about email threats and how organisations’ protection stacks up over time. Useful context for anyone tuning their Defender email-security posture.

Security — Industry recognition

Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave

Microsoft has been named a Leader in Forrester’s 2026 Wave for Extended Detection and Response (XDR) platforms, reflecting the strength of its unified, cross-domain detection and response offering.

Infrastructure — Azure at scale

Azure sets a new performance record for LLM training benchmark at extreme scale

Azure has set a new performance record on a large-language-model training benchmark at extreme scale, underscoring the platform’s strength for the very largest AI training workloads.

After hours

The Hidden Backdoors Inside Millions of Smart Devices – https://www.youtube.com/watch?v=apEPPKYgLL0

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260606

Events — Microsoft Build 2026

Build 2026: Furthering Windows as the trusted platform for development(opens in new window) At Build 2026, Microsoft laid out a wave of developer-focused Windows updates aimed at reducing setup friction and making Windows the place to build and run AI agents. Highlights include Coreutils for Windows, WSL containers, one-command Windows Developer Configurations, and a new security layer called Microsoft Execution Containers (MXC) that lets developers tightly control what an AI agent can access. It matters because it signals Microsoft’s push to fold secure, on-device AI agents directly into the Windows developer experience.

Announcements — New Products

Introducing Microsoft Scout: Your always-on personal agent(opens in new window) Microsoft unveiled Scout, an “always-on” personal agent that works in the background across your Microsoft 365 apps, holding your priorities and acting on your behalf rather than just answering one-off questions. Scout is part of a new category Microsoft calls “Autopilots” — agents that run autonomously with their own identity, within the permissions you and your organisation set. (Shared as a video; full write-up is on the Microsoft 365 Blog(opens in new window).)

Industry News — Security

The next frontier in endpoint security: Securing local AI agents with Microsoft Defender(opens in new window) Tied to Build 2026, Microsoft extended its Agent 365 and Defender protections to cover AI agents running locally on a device, not just cloud-based ones. The idea is to give security and IT teams the same visibility, governance, and threat protection over local agents that they already have over human users, helping prevent these autonomous agents from becoming a new enterprise risk.

AI

Announcements & Product Launches

Introducing Microsoft Scout (video) — A companion video walkthrough showing Scout in action as a personal agent. It’s a visual introduction to the same Scout launch covered in the blog. https://www.youtube.com/watch?v=3ff6UtpPQv8(opens in new window)
Announcing the new Work IQ APIs — Microsoft announced new Work IQ APIs that let developers and agents tap into real Microsoft 365 work context. This extends Work IQ beyond the CLI/MCP preview into a programmable platform. https://www.microsoft.com/en-us/microsoft-365/blog/2026/06/02/announcing-the-new-work-iq-apis/(opens in new window)
Learning Agent now generally available — Microsoft’s Learning Agent reached general availability, offering personalized AI-driven upskilling for every employee. It aims to help workers build skills directly within their Microsoft 365 experience. https://techcommunity.microsoft.com/blog/microsoft365copilotblog/learning-agent-now-generally-available-%E2%80%94-personalized-ai-upskilling-for-every-em/4524571(opens in new window)

AI Models & Research

Building a hill-climbing machine: Launching seven new MAI models — Microsoft AI announced a set of seven new in-house MAI models, framed as part of an iterative “hill-climbing” approach to model improvement. The post covers the new model lineup and the strategy behind it. https://microsoft.ai/news/building-a-hillclimbing-machine-launching-seven-new-mai-models/(opens in new window)
Frontier Tuning: Teaching AI to work the way you do — A developer-focused post on “Frontier Tuning,” a technique for adapting AI to match individual and organizational working styles. It’s aimed at developers building more personalized agent experiences. https://devblogs.microsoft.com/microsoft365dev/frontier-tuning-teaching-ai-to-work-the-way-you-do/(opens in new window)
OpenClaw + Windows: Microsoft Build 2026 (video) — A Build 2026 session video covering OpenClaw and its integration with Windows. https://www.youtube.com/watch?v=J7ol1VDkg7w(opens in new window)

Events

Frontier Transformation Engineer Summit — An event listing for the Frontier Transformation Engineer Summit, part of Microsoft’s FY26 skilling program. https://www.skilling-hub.com/listing/o::fy26-fps-06(opens in new window)

Productivity & Copilot Tips

Find skill-building volunteer opportunities with Microsoft Copilot — A how-to post showing how Copilot can help you discover volunteer opportunities that also build your skills. It’s a practical tip for using Copilot beyond day-to-day work tasks. https://techcommunity.microsoft.com/blog/Microsoft365InsiderBlog/find-skill-building-volunteer-opportunities-with-microsoft-copilot/4423657

After hours

Microsoft Build 2026: See All the Highlights in 15 Minutes – https://www.youtube.com/watch?v=1PSHObgyJpw

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260530

Introducing Microsoft 365 Business with Copilot: The new standard for small business(opens in new window) Microsoft is launching two new small-business SKUs on 1 July — Business Standard with Copilot and Business Premium with Copilot — with Copilot built directly into Word, Excel, PowerPoint and Outlook. They add 1,000+ connectors (Shopify, Xero, Docusign and more), “Work IQ” business context, and access to OpenAI and Anthropic models. Built-in security controls like sensitivity labels and access revocation ensure Copilot only surfaces what each user is permitted to see.
Introducing a new design for Microsoft 365 Copilot(opens in new window) Microsoft has redesigned the Copilot experience across Microsoft 365, turning the prompt line into a task-aware workspace with a single consistent entry point across apps and a progressive-disclosure interface. Performance improved with load times cut by more than half and complex prompts answering ~10% faster, alongside new agentic modes (Designer, Researcher, and in-app Word/Excel/PowerPoint agents). Microsoft reported usage gains of Word +27%, Excel +33%, PowerPoint +43% and Outlook +30%.

Security / Industry News

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor(opens in new window) Microsoft Threat Intelligence analysed “The Gentlemen,” a ransomware-as-a-service threat (operators tracked as Storm-2697) written in Go that uses per-file Curve25519 + XChaCha20 encryption and spreads aggressively through lateral movement. It employs double extortion, disables Microsoft Defender, and deletes shadow copies and logs to hinder recovery. Activity has been observed globally across education, transport, healthcare and finance sectors.

After hours

Mark Rober’s $60 Million Science Experiment – https://www.youtube.com/watch?v=RDFGkBE2O50

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260516

Security & Threat Intelligence

Configuration becomes vulnerability: Exploitable misconfigurations in AI apps (14 May) Microsoft Defender researchers found that AI and agentic apps deployed on Kubernetes (Mage AI, kagent, AutoGen Studio, MCP servers, and others) are frequently exposed to the internet with weak or missing authentication, enabling remote code execution, credential theft, and data exposure without any zero-day exploit. Defender for Cloud signals show >50% of cloud-native workload exploitations stem from these misconfigurations. https://www.microsoft.com/en-us/security/blog/2026/05/14/configuration-becomes-vulnerability-exploitable-misconfigurations-ai-apps/(opens in new window)
Kazuar: Anatomy of a nation-state botnet (14 May) Deep technical analysis of Kazuar, a Russian state actor (Secret Blizzard) malware family that has evolved from a traditional backdoor into a modular peer-to-peer botnet with Kernel/Bridge/Worker components, leader-election for stealth, and multiple fallback C2 channels (HTTP, WebSockets, Exchange Web Services). Used to target government and diplomatic organisations in Europe, Central Asia, and Ukraine. https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/(opens in new window)
Undermining the trust boundary: Stealthy intrusion through third-party compromise (12 May) Microsoft Incident Response details a 100+ day intrusion in which attackers abused a compromised third-party IT services provider and the legitimate HPE Operations Agent platform to deploy VBScripts, malicious network providers, and password filter DLLs on domain controllers, harvest credentials, and persist via web shells and ngrok tunnels — all without malware-heavy techniques. https://www.microsoft.com/en-us/security/blog/2026/05/12/undermining-the-trust-boundary-investigating-a-stealthy-intrusion-through-third-party-compromise/(opens in new window)

Microsoft 365 & Teams

Goodbye Together mode, hello simplified meeting layouts in Microsoft Teams (15 May) Microsoft is retiring Together mode (and its scenes/seat assignments) from Teams on 30 June 2026. The modern Gallery view — which scales up to 49 participant tiles and adapts to device capability — becomes the single meeting layout, freeing engineering effort for video quality, super-resolution, denoising, and colour accuracy improvements. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/goodbye-together-mode-hello-simplified-meeting-layouts-in-microsoft-teams/4519312(opens in new window)

Windows

Improving Windows quality: Making Taskbar and Start more personal (15 May) Windows Insiders in the Experimental channel can now move the taskbar to the top, left, or right of the screen (with matching icon alignment and Start flyout positioning), enable a smaller compact taskbar, and use new section-level toggles for Pinned / Recommended / All in the Start menu. “Recommended” is also being renamed to “Recent”. https://blogs.windows.com/windows-insider/2026/05/15/improving-windows-quality-making-taskbar-and-start-more-personal/(opens in new window)

Power Platform

What’s new in Power Platform: May 2026 feature update (15 May) Power Fx user-defined types (UDTs) and the Grid container control are now generally available. New previews include custom MCP-powered tools and rich Fluent UI widgets for app-based Copilot conversations, generative pages with input context, a new high-performance Data Grid modern control, OnSelect on the Icon control, and a PowerCAT skill for migrating retired InfoPath forms to Canvas Apps using AI coding agents. https://www.microsoft.com/en-us/power-platform/blog/2026/05/14/whats-new-in-power-platform-may-2026-feature-update/(opens in new window)

AI & Copilot

Microsoft tests ‘ClawPilot’ AI agent for 3,000 staff (9 May) Microsoft is piloting an OpenClaw-based “ClawPilot” AI agent with more than 3,000 employees, aiming to deliver always-on assistants that handle tasks across Microsoft 365 — part of a broader industry push around agent governance. https://www.msn.com/en-us/news/other/microsoft-tests-clawpilot-ai-agent-for-3000-staff/gm-GM67972661

After hours

Reimagining the mouse pointer with AI – https://www.youtube.com/watch?v=pZNzfQLgGsA

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260509

Here’s a summary of the 10 stories posted in the Patrons News channel over the last 7 days, grouped by topic.

Security & Threat Intelligence

SOHO router compromise leads to DNS hijacking and AiTM attacks — Microsoft Threat Intelligence reports that Russian military-linked actor Forest Blizzard (sub-group Storm-2754) has compromised insecure home/small-office routers, redirecting DNS to attacker-controlled infrastructure to enable adversary-in-the-middle attacks against Outlook on the web. Over 200 organisations and 5,000 consumer devices have been impacted since August 2025. https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/
ClickFix campaign uses fake macOS utilities to deliver infostealers — Threat actors are posting fake macOS troubleshooting guides on Medium, Squarespace and Craft pages instructing users to paste Terminal commands that install Macsync, Shub Stealer or AMOS infostealers, which exfiltrate Keychain entries, iCloud data and crypto wallet keys (and sometimes replace Ledger, Trezor and Exodus apps with trojanised versions). https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/
Multi-stage ‘code of conduct’ phishing leads to AiTM token compromise — A large credential-theft campaign (April 14–16) targeted ~35,000 users across 13,000 organisations in 26 countries, mostly US, using polished “internal regulatory” emails with PDF attachments. The chain ran through CAPTCHAs and staging pages before hitting an AiTM Microsoft sign-in flow that captures auth tokens. https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/

Microsoft 365 Product Updates

What’s new in Microsoft Teams – April 2026 — Headline features include Copilot call delegation, Interpreter agent enhancements (consecutive interpretation, sign-language attribution), targeted messages from agents, sensitivity-label inheritance for recordings and Loop notes, an External Domains Anomalies Report, and Teams Phone user multi-line (up to 10 numbers per user). https://techcommunity.microsoft.com/blog/microsoftteamsblog/whats-new-in-microsoft-teams–april-2026/4515907
Microsoft 365 E7 and Agent 365 are now generally available — Microsoft’s new top-tier M365 SKU and the Agent 365 platform have moved to general availability (announced 1 May 2026). https://techcommunity.microsoft.com/blog/microsoft_365blog/microsoft-365-e7-and-agent-365-are-now-generally-available/4516295
Get more out of Microsoft Clipchamp with these little-known features — A walk-through of Brand kits for consistent logos/colours/fonts, fade and blur transitions, automatic captions, aspect-ratio presets for repurposing content, and built-in stock search — plus Copilot in the Clipchamp video hub for searchable, summarised playback. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/get-more-out-of-microsoft-clipchamp-with-these-little%E2%80%91known-features/4514855

Identity, Security & SIEM Platform

Lock down AI, web and private apps – what’s new in Internet Access and Private Access — Updates to Microsoft Entra’s Global Secure Access covering tighter controls for AI traffic, web and private application access. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/lock-down-ai-web-and-private-apps-what%E2%80%99s-new-in-internet-access-and-private-acce/3847825
What’s new in Microsoft Sentinel – April 2026 — RSAC-aligned updates including OSINT reports inside Threat Analytics, hard cost-limit enforcement for KQL queries and notebooks, new connectors (CrowdStrike, Imperva Cloud WAF, AWS ELB, rebuilt Logstash output plugin), Sentinel data federation, custom graphs, MCP entity analyzer GA and a Claude MCP connector. https://techcommunity.microsoft.com/blog/MicrosoftSentinelBlog/what%E2%80%99s-new-in-microsoft-sentinel-april-2026/4516354

CIAOPS Content

CIA Brief 20260502 — Robert’s weekly roundup of Microsoft 365, Copilot, AI and security news for the week ending 2 May 2026, covering items including the M365 E7 / Agent 365 GA announcement. https://blog.ciaops.com/2026/05/02/cia-brief-20260502/

Archive / Reference

The Future of SharePoint (2016 post) — Jeff Teper’s original “Future of SharePoint” announcement from May 2016, unveiling the cloud-first, mobile-first SharePoint vision, modern team sites, the SharePoint mobile app and the SharePoint Framework. Reposted to the channel for reference. https://www.microsoft.com/en-us/microsoft-365/blog/2016/05/04/the-future-of-sharepoint/

After hours

Why Would Anyone Live in NYC? – https://www.youtube.com/watch?v=POg3_b9txwM

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week