Microsoft Copilot Cowork Exfiltrates Files

Microsoft Copilot Cowork, a frontier feature in Microsoft 365, is vulnerable to file exfiltration via indirect prompt injection. Attackers can poison a skill file uploaded by a user; when the agent is triggered, it sends a Teams or Outlook message containing malicious HTML image tags that embed pre-authenticated SharePoint/OneDrive download links as query parameters to an attacker-controlled server — all without requiring human approval. The attack succeeded 5 out of 5 trials and works against Claude Opus 4.7. Scheduled tasks amplify the risk since they run without user oversight. Mitigations include restricting SharePoint download policies via PowerShell, though these impact legitimate functionality. A separate sandbox data-egress vulnerability has also been disclosed to Microsoft.