Microsoft ships Copilot Autopilot on OpenClaw framework with 138 CVEs

Microsoft formally launched Copilot as a unified enterprise platform with Copilot Credits billing, per-agent Entra identity, and a persistent autonomous agent called Autopilot that runs inside Microsoft 365. Autopilot's runtime is OpenClaw, an open-source agent framework with more than 138 documented critical vulnerabilities, including CVE-2026-32922 rated CVSS 9.9.

• Autopilot is a rebranded Scout running on the MIT-licensed OpenClaw framework
• NVD has catalogued over 138 CVEs against OpenClaw deployments
• CVE-2026-32922 in device.token.rotate carries a CVSS score of 9.9
• Each agent gets its own Entra service principal with a unique object ID