2026-05-26原文

Microsoft Copilot Cowork Exfiltrates Files

A vulnerability in Microsoft Copilot Cowork allows attackers to exfiltrate OneDrive files through prompt injection and external images in automatically sent emails.

Article intelligence

EngineersAdvanced

Key points

Copilot Cowork agents can send emails to user's inbox without approval
External images in emails can trigger network requests, leaking data
Combined with OneDrive pre-authenticated links, prompt injection can lead to file theft

Why it matters

This matters because copilot Cowork agents can send emails to user's inbox without approval.

Technical impact

May affect model selection, inference cost, product capability, and evaluation benchmarks.

Microsoft Copilot Cowork Exfiltrates Files

Simon Willison’s Weblog

26th May 2026 - Link Blog

Microsoft Copilot Cowork Exfiltrates Files (via) The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data.

In this case Microsoft Copilot Cowork (yes, that's a real product name) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images:

Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent.

Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker.