CoPilot directory Cowork, a frontier feature in Microsoft 365, is susceptible to file exfiltration attacks via indirect prompt injection. The vulnerability stems from insecure automatic action approvals for sending emails and Teams messages.
Researchers at PromptArmor demonstrated that by injecting a poisoned skill file, an attacker can manipulate Copilot Cowork into exfiltrating pre-authenticated file download links. The attack achieved a high success rate against state-of-the-art models including Claude Opus 4.7 and Claude Sonnet 4.6.
Overview of the Vulnerability
Copilot Cowork operates with the user's Microsoft permissions and uses Microsoft Graph to read and act on data within the Microsoft tenant. According to Microsoft's documentation, Copilot Cowork asks for permission before taking sensitive actions like sending an email or posting a Teams message. However, when the recipient is the active user, these actions execute immediately without human approval. Users have no setting to modify this behavior.
Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Copilot Cowork can retrieve pre-authenticated download links for files the user has access to. These links allow anyone who opens them to download the file. A manipulated agent can exfiltrate files by passing these links to an attacker-controlled site.
The Attack Chain
The attack begins when a victim uploads a skill file to Copilot Cowork that contains a prompt injection. This is common because users often find files online and upload them as skills. The attack does not depend on the injection source. Other injection sources include web data from Claude for Chrome, connected MCP servers, and more.
Admins have limited oversight of skills because Copilot Cowork automatically loads skills from a specific path in a user's OneDrive.
When the victim asks Copilot Cowork to review what they worked on that week, the skill triggers. The injection manipulates the agent to post a Teams message that will exfiltrate pre-authenticated file download links when viewed. The injection tells Copilot Cowork that a service exists to create document previews for the recap message. To do this, the agent retrieves pre-authenticated file download links for each file and passes those URLs as query parameters to an attacker-controlled site via malicious HTML image tags.
At no point in this process is human approval required. Even when the user expands the task completion block in Copilot Cowork, the malicious message content is never visible. When the user opens their Teams messages, the pre-authenticated download links are exfiltrated, and the attacker can download the files.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
Mitigating Risks for Your Organization
Microsoft Copilot Cowork has read access to essentially any resource a user does through Microsoft Graph. The primary mechanism to reduce the blast radius of these attacks is to restrict excessive permissioning across the Microsoft ecosystem.
To limit users' ability to retrieve pre-authenticated download links for files, administrators can restrict file downloads from SharePoint by running commands in the SharePoint Online Management Shell. For example, they can run Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true or block based on a sensitivity label using Set-Label. This configuration affects functionality. Files under the BlockDownloadPolicy policy only allow browser-only access with no ability to download, print, or sync files. Users also cannot access content through Microsoft 365 Apps like Word, Excel, PowerPoint, and others.
Model Agnostic Exploitation
The attack chain was initially conducted with the model selection set to auto, which dynamically routes between Claude Opus 4.7 and Claude Sonnet 4.6. Researchers validated that the attack succeeds with the exact same injection on the more advanced Opus 4.7 model by setting the model directly. Opus 4.7 was more comprehensive in its search for recently edited documents. It expanded exfiltration to include every document used in previous Cowork Copilot sessions that week, as well as files stored in more typical document locations.
Prompt Injection Efficacy
The prompt injection exhibited a very high efficacy. Copilot Cowork completed the entire attack chain on every trial, five out of five times. The attack was not contingent on the specific wording of the user query. Whenever the model invoked the skill, the injection succeeded.
The injection consisted of five lines in an 81 line skill file, all of comparable length to the other lines. This demonstrates that even with the latest models and only a small excerpt of malicious text, an indirect prompt injection can hijack agent behavior. Researchers urge readers to exercise caution when working with untrusted data such as skills shared online, especially when the untrusted data is placed into a trusted context like a skill file.
Scheduled Tasks Exacerbate Risks
In Copilot Cowork, users can create scheduled tasks. A scheduled task is a prompt that executes on a recurring basis without user oversight. The weekly review behavior described in this article is the exact kind of task a user would be likely to automate with a scheduled task. Scheduled tasks increase the risk surface for attacks like this significantly. The user is not present to stop malicious workflows, and the prompt injections can take effect on a recurring basis.