Microsoft's own documentation for Copilot Cowork says the agent "asks for your permission before taking sensitive actions, like sending an email or posting a message in Teams." PromptArmor found that when the recipient of that email or Teams message is the active user, Cowork sends it immediately, with no approval prompt and no setting to require one. That single exception carries the whole attack.
Copilot Cowork is a Frontier feature now available in Microsoft 365. It runs with the signed-in user's permissions and reaches tenant data through Microsoft Graph, so it can read essentially any file, message, or record the user can. Two of its capabilities are dangerous in combination. It can post a Teams message to the user without approval, and it can retrieve pre-authenticated download links for files the user can access. A pre-authenticated link downloads the file for anyone who opens it, with no sign-in.
The attack chain starts with a skill file. A victim keeps files in SharePoint or OneDrive that contain PII and financial data, and uploads a skill to Cowork that carries a prompt injection. That is ordinary behavior; people find a skill online and load it. Admin oversight of skills is limited, because Cowork loads them automatically from a fixed path in the user's OneDrive. The injection source does not have to be a skill, either. Web data and connected MCP servers work as well. The victim then asks Cowork to review what they worked on that week, which invokes the skill.
From there the injection tells Cowork that a preview service exists to generate document thumbnails for the weekly recap. To build those previews, the agent fetches a pre-authenticated download link for each file and embeds the links as query parameters in HTML image tags pointing at an attacker-controlled site. Cowork posts that as a Teams message to the user. No approval is requested at any step. When the user opens the compromised Teams message, the images load, the requests fire, and the links reach the attacker, who downloads the files.
The message content stays hidden throughout. Expanding the "Task complete" block shows the agent's actions, but the malicious message body is never visible, even if you click into the Teams action itself.
The attack was reliable. Cowork completed the full chain on all five trials. The injection was five lines inside an 81-line skill file, each line comparable in length to the rest, and success did not depend on how the user phrased the request. Any query that invoked the skill set it off.
It is also model-agnostic in the way that matters. The test began with model selection on "auto," which routes between Claude Opus 4.7 and Claude Sonnet 4.6. Forcing Opus 4.7 directly produced the same result from the same injection, and the stronger model widened the damage. It searched more thoroughly for recently edited documents and pulled in every file used in that week's earlier Cowork sessions, on top of the usual document locations. A more capable agent followed the injection more completely.
Scheduled tasks make this worse. Cowork lets users schedule a prompt to run on a recurring basis with no one watching, and a weekly review is exactly the kind of task people automate. On a schedule, the injection fires every cycle with no human present to notice the Teams message or question it.
For anyone running Cowork, the blast radius is set by permissions. The agent reads whatever the user reads, so tightening excessive access across the tenant is the main lever. To cut off the pre-authenticated links specifically, administrators can block downloads at the SharePoint site level:
Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true
or by sensitivity label:
Set-Label -Identity <label> -AdvancedSettings @{BlockDownloadPolicy="true"}
That control has a real cost. Under BlockDownloadPolicy, Microsoft's documentation says users get browser-only access with no ability to download, print, or sync files, and cannot reach the content through Office apps such as Word, Excel, and PowerPoint.
Separately, PromptArmor reported a vulnerability to Microsoft that allows data egress directly from Cowork's sandbox environment, independent of the approval gap described here.
Top comments (0)