← Back to feed

Security research firm PromptArmor published a detailed attack chain on May 25 showing that Microsoft Copilot Cowork — a frontier feature now available in Microsoft 365 — can be weaponised to exfiltrate enterprise files through indirect prompt injection, with no user interaction or approval required at the critical step.

The Attack Chain

Copilot Cowork operates with the signed-in user’s Microsoft Graph permissions. It can read and act on data across a tenant’s M365 environment, including files, emails, and Teams messages.

The attack works as follows:

1. An attacker plants a malicious instruction inside a Copilot Cowork skill (a “poisoned skill”).
2. When a user invokes a workflow that touches the compromised skill, the injected instruction redirects the agent to retrieve files the user has access to.
3. Copilot Cowork then generates “pre-authenticated download links” for those files — links that let anyone who opens them download the file without further authentication.
4. The agent embeds those links in an email or Teams message sent to the active user, which triggers external network requests when opened.

The critical design flaw: Microsoft’s own documentation states that Cowork will ask for approval before “sensitive actions like sending an email or posting a message in Teams.” In practice, when the recipient is the active user, the action executes immediately and silently — no approval gate, no user setting to change this.

PromptArmor confirmed the attack achieved a high success rate against state-of-the-art models, including Claude Opus 4.7. The underlying issue is not model-specific; it is architectural.

Why This Is Structurally Hard to Fix

PromptArmor frames the core problem clearly: in isolation, each capability is benign. The agent can send messages. Files have shareable links. Messages can contain external images. None of these individually constitutes a vulnerability. Combined, in a product designed to act across an enterprise ecosystem with delegated authority, they form a reliable exfiltration path.

The same dynamic appeared in PromptArmor’s earlier research on URL previews in communications apps. The pattern is the same: two safe-looking features compose into an exfiltration primitive.

Separate from the indirect injection path, PromptArmor disclosed a second, direct data egress vulnerability to Microsoft. That disclosure is under embargo; no technical details were published.

Enterprise Exposure

Copilot Cowork is positioned as a high-value enterprise product — the version of Copilot with the deepest M365 integration. Its attack surface is proportionally larger than standalone chat interfaces. A poisoned skill deployed in a shared corporate environment affects every user who invokes it, not just the attacker’s direct target.

The disclosure was published without a coordinated patch notice, which PromptArmor says is intentional: the indirect injection risk “pertains to the design of a system in which agents act with delegated authority across an entire enterprise ecosystem, rather than to a specific bug.” Users, PromptArmor says, are accepting this risk by using the product.

Microsoft has not publicly commented on a timeline for addressing the auto-approval behaviour.