Microsoft Copilot Cowork: document exfiltration via prompt injection

PromptArmor demonstrated a file exfiltration attack using a poisoned skill — a file containing instructions for an AI agent.

The victim uploaded the skill and asked Copilot Cowork to summarize their work for the week. The malicious instructions manipulated the agent into searching SharePoint and OneDrive for documents and retrieving pre-authenticated download links, which allow files to be downloaded without additional authentication.

Copilot then sent the user a Teams message containing external image references. The document download links were embedded in the image URLs. When the user opened the message, Teams loaded the images, sending those URLs to an attacker-controlled server.

Result: the full attack chain succeeded in 5 out of 5 trials. Sending a Teams message to the active user did not require approval, but the user still had to open the message to trigger exfiltration.

The agent acted using the user's legitimate permissions while following instructions from an untrusted source. Similar injections could potentially originate from web content or connected MCP servers.

Article (Copilot): https://www.promptarmor.com/resources/microsoft-copilot-cowork-exfiltrates-files