A vulnerability was discovered in the Microsoft 365 Agents SDK, identified as CVE-2026-109485. The issue is a server-side request forgery (SSRF) bug that enables an authorized attacker to disclose information over a network. This vulnerability allows an attacker with access to the affected system to make unauthorized requests on behalf of the system, potentially leading to sensitive information exposure. The bug affects the Microsoft 365 Agents SDK, which is used by developers to integrate Microsoft services into their applications. This vulnerability matters to developers and operators of AI agents as it may compromise the security and integrity of their systems if not addressed promptly.