Researchers show Microsoft Copilot Cowork can leak Microsoft 365 files through indirect prompt injection and auto-approved messages

Security researchers say Microsoft Copilot Cowork can be manipulated via indirect prompt injection in a poisoned skill to exfiltrate files from a Microsoft 365 tenant. The attack abuses the agent’s delegated permissions and the fact that some email and Teams message actions can proceed without human approval, then trigger attacker-controlled network requests when opened.

The finding highlights a broader enterprise risk: agentic tools that span mail, chat, files, and identity systems can turn benign integrations into data exfiltration paths. As workplace AI agents gain more autonomy, vendors may need stricter action approvals, sandboxing, and egress controls rather than relying on model behavior alone.

Microsoft Copilot Cowork Exfiltrates Files