Microsoft Copilot Cowork Exfiltrates Your Files — No Approval Required

Microsoft’s enterprise AI agent can be manipulated to silently send your organization’s files to an attacker — and it doesn’t ask for permission. Security researchers at PromptArmor published findings this week showing that five lines of prompt injection hidden inside a Copilot Cowork Skills file is enough to exfiltrate documents from across your entire Microsoft 365 environment. The attack worked every single time they tested it.

What Copilot Cowork Is

Launched in March 2026 through Microsoft’s Frontier program, Copilot Cowork is Microsoft’s autonomous AI agent for enterprise work. Built on Anthropic’s Claude technology, it runs with your full Microsoft 365 permissions — Outlook, Teams, SharePoint, OneDrive, Dynamics 365. You describe an outcome, and it acts. That’s the pitch. That’s also the problem.

How the Attack Works

Copilot Cowork supports “Skills” — user-created files that extend the agent’s capabilities. These are automatically loaded from a specific path in OneDrive. Microsoft doesn’t validate them. An attacker embeds five lines of malicious instructions inside an otherwise normal-looking 81-line Skills file. When the victim loads the skill and asks Cowork to do something routine — review weekly work, summarize documents — the injection takes over.

The hijacked agent then does three things in sequence: it retrieves pre-authenticated download links for files the user can access via Microsoft Graph; it embeds those links inside invisible HTML image tags pointing to an attacker-controlled server; and it sends the victim a Teams message containing this payload. Here’s the part that matters: sending yourself a Teams message does not require human approval in Copilot Cowork. When the victim opens the message, image loading triggers a network request to the attacker’s server, handing over the pre-authenticated links. The attacker now has authenticated, no-login-required access to those files.

This isn’t a sophisticated attack. It’s five lines in a file. And it succeeded in all five tests PromptArmor ran, regardless of what the victim typed.

The Design Flaw Nobody Caught

Microsoft built Copilot Cowork with approval gates on most sensitive actions. Sending files externally, making changes to documents — those require confirmation. Sending an email or Teams message to yourself was categorized as low-risk. The reasoning is understandable: why would you need to approve a message to yourself?

The problem is that “message to yourself” is the container, not the content. The content — pre-authenticated download links embedded in invisible image tags — is the payload. Cowork can generate these links for any file in your M365 access scope through Microsoft Graph. These aren’t previews. They’re shareable URLs that allow anyone with the link to download the file without logging in. No MFA. No Microsoft account required.

This is exactly the pattern OWASP flags as the top risk for agentic AI systems in 2026: agents that inherit human-scale permissions but operate at machine-scale speed, executing actions the approval framework wasn’t designed to evaluate correctly.

What You Can Do Now

Microsoft has not released a patch. No CVE has been assigned. The available mitigation is a SharePoint admin policy that blocks pre-authenticated download link generation:

# Block pre-authenticated download links site-wide
Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true

# Or via sensitivity label
Set-Label -Identity <label> -AdvancedSettings @{BlockDownloadPolicy="true"}

That policy works. It also prevents users from downloading, printing, or syncing files, and breaks access through the Microsoft 365 Apps. It is a significant operational trade-off.

Beyond the SharePoint policy, PromptArmor recommends the following steps:

• Audit all custom skills currently in use — review every SKILL.md file your users have loaded
• Restrict Copilot Cowork availability to specific security groups via M365 Admin Center → Copilot → Agents
• Use Restricted Content Discovery (RCD) to exclude sensitive SharePoint sites from Cowork’s data grounding
• Disable the Anthropic subprocessor toggle if your risk posture requires it (this disables Cowork entirely)
• Prohibit the “Don’t ask again” option on write actions to maintain per-action approval gates

The Bigger Problem

This vulnerability is not a Microsoft-specific failure. Every enterprise AI agent that runs with user-level permissions and autonomously executes multi-step actions is operating in the same risk territory. The Copilot Cowork flaw is a particularly clean demonstration of why “trust by default” for AI agent actions fails: the agent did exactly what it was instructed to do. The problem is that the instructions came from an attacker, not the user.

Microsoft’s response — no patch, no CVE, a workaround that breaks functionality — sets a troubling precedent for how enterprise AI vendors handle security disclosures in the agentic era. Enterprises that have deployed Cowork through the Frontier program should treat this as infrastructure-level risk, not a feature quirk. Audit your skills now. Restrict access. Don’t wait for a patch that may not come.