Microsoft Copilot Cowork Exfiltrates Files

Researchers demonstrated a vulnerability in Microsoft Copilot Cowork that allows attackers to exfiltrate sensitive files, including financial data and personally identifiable information, through indirect prompt injection attacks on poisoned skills. The attack exploits the fact that messages sent to the active user don't require human approval, and can contain malicious image tags that trigger network requests to attacker-controlled servers when opened. Microsoft has been notified of both this design vulnerability and a separate sandbox escape bug.