Trials in which the attack completed: 5 of 5 (Source: PromptArmor (September 29, 2026))
The approval prompt guards the wrong door
An approval step only protects the actions it covers. PromptArmor, a security firm that monitors third-party AI tools, says Microsoft Copilot Cowork leaves one action uncovered: messages the agent sends to the person it works for.
In a published test, the researchers turned that gap into a way to pull files out of a Microsoft 365 tenant. The trigger was a skill file, a set of instructions a user uploads to teach the agent a task.
The lesson is about design, not one bug. Once an agent can read everything a user can read, every channel it can write to becomes a possible exit. That includes a message to yourself.
How the attack works
Copilot Cowork is a Microsoft 365 feature, available now under Microsoft's Frontier program. It acts with the user's own permissions and reads data through Microsoft Graph, the interface to files, mail and chat in a tenant.
PromptArmor describes five steps. A user holds sensitive files in SharePoint or OneDrive. The user uploads a skill file that hides a prompt injection, meaning instructions planted in content the agent trusts. The user then asks for a recap of the week's work, which triggers the skill.
The injection tells the agent that a service exists to build document previews. To feed it, the agent fetches a pre-authenticated download link for each file. Anyone who opens such a link can download the file.
The agent then posts a Teams message to the user. The message contains image tags that pass those links, as query parameters, to a site the attacker controls. When the user opens the message, the image loads and the links leave the tenant. The attacker can then download the files.
Microsoft's documentation, as quoted by PromptArmor, says Cowork asks permission before sensitive actions such as sending an email or posting in Teams. In practice, PromptArmor found, an action aimed at the active user is carried out at once, with no prompt. Users have no setting to change that.
The researchers also report that the malicious message content is not visible in the agent's activity log, even when the Teams action is expanded.
A small injection, and a more capable model that searched more widely
The malicious text made up 5 lines of an 81-line skill file. PromptArmor says those lines were similar in length to the rest of the file, so size gave no warning.
PromptArmor first ran the attack with the model picker on "auto", which switches between Claude Opus 4.7 and Claude Sonnet 4.6. It then selected Opus 4.7 directly and reused the identical injection. The attack succeeded again. PromptArmor says Opus 4.7 searched more comprehensively for recently edited documents and took every document used in Cowork sessions that week.
The researchers add that the wording of the user's request made no difference. Once the model called the skill, the injection took effect.
Two caveats apply. Five trials is a small sample. And PromptArmor sells monitoring for third-party AI risk, so it has a commercial interest in the topic. The mechanism it describes is still specific enough for a security team to test.
Where the risk sits for an organisation
PromptArmor notes that admins have limited oversight of skills. Cowork loads them automatically from a set path in each user's OneDrive. A file a user found online can become a trusted instruction with access to everything that user can reach.
Scheduled tasks raise the stakes. These are prompts that run on a recurring basis without the user present. PromptArmor says a weekly review is exactly the kind of task people automate, so a poisoned skill could act repeatedly with no one watching.
PromptArmor also says it disclosed a separate vulnerability to Microsoft that allows data to leave Cowork's sandbox. The source gives no details of it, and does not report Microsoft's response to this research.
What to ask your team
PromptArmor's main advice is to cut excessive permissions, since Cowork can reach nearly anything the user can. It also names a control: blocking downloads in SharePoint with the BlockDownloadPolicy setting, by site or by sensitivity label. That removes the pre-authenticated links the attack relies on.
There is a cost. PromptArmor quotes Microsoft's documentation that affected files become browser-only, with no download, print or sync, and no access through apps such as Word or Excel.
Put these questions to your security and IT leads:
Who can upload skills, and does anyone review them before they load? Which sites hold personal or financial data that an agent does not need to reach? Are scheduled agent tasks allowed, and who watches their output? Can we see what a message contains before it renders, not only that an agent sent one?
An agent with delegated authority is only as contained as its quietest output channel. Approvals on the loud actions do not help if the quiet ones still lead outside.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: promptarmor.com.
