Microsoft Copilot Cowork exposed to serious security vulnerability: corporate files can be stolen through indirect prompt injection

Core conclusion

Security research firm PromptArmor disclosed in May 2026 that Microsoft Copilot Cowork, the AI Agent feature of Microsoft 365, has a serious indirect prompt injection security vulnerability. An attacker only needs to plant 5 lines of malicious instructions in the Skill file uploaded by the user, so that Copilot Cowork can automatically send malicious Teams messages carrying pre-authentication file download links to the user. When the user opens the message, the file will be stolen.

Key Points

• Time of incident: Disclosed in mid-May 2026 -Affected: All businesses and organizations using Microsoft Copilot Cowork
• Core change: AI Agent's automatic operation approval mechanism has become an attack surface, and Claude Opus 4.7 cannot defend against it. -Severity: The malicious Skill file can be injected with only 5 lines, and the attack success rate is 100% (5/5 test)

Security vulnerability details

In May 2026, security research firm PromptArmor released a detailed research report revealing a concerning security vulnerability in Microsoft Copilot Cowork. Copilot Cowork is Microsoft 365's cutting-edge AI Agent feature that uses a user's Microsoft permissions and the Microsoft Graph to read and manipulate enterprise data.

Attack chain analysis

Fatal flaw in automatic operation approval

Microsoft's documentation claims: "[Copilot] Cowork requests permission before performing sensitive actions, such as sending an email or posting a message in Teams." However, when the recipient is the current user, these actions are performed automatically without anyone's approval. There are no settings for the user to modify this behavior.

Since Teams and Outlook support external images (which trigger network requests when loaded), attackers can exploit this to exfiltrate data the moment a user opens a message.

A bigger threat: Claude Opus 4.7 was also compromised

PromptArmor's testing showed that the attack was equally successful even when the model was set to manually select the latest Claude Opus 4.7. What's more noteworthy is that Opus 4.7 is more 'responsible' than the automatic mode - it searches all documents edited by the user throughout the week, resulting in a larger scope of data leakage.

The attack succeeded in every test (all 5 tests succeeded). The attack chain does not depend on the specific wording of the user query - as long as the model calls the compromised Skill, the injection will take effect.

Greater systemic risk: It’s not just Microsoft’s problem

PromptArmor’s research shows that this is a systemic AI agent security issue. The same research organization also found:

• Claude Cowork has the same file stealing vulnerability
• Codex for Everything can leak connected data
• Google Antigravity, Notion AI, Slack AI, etc. all have similar injection risks
• Snowflake Cortex AI can escape the sandbox and execute malicious code

This reveals a fundamental problem: when an AI agent gains authorized access to an enterprise system, the attack surface for indirect prompt injection grows exponentially. None of the current cutting-edge models, including the Claude Opus 4.7, offer adequate protection.

How Businesses Defend

Short-term protective measures

PromptArmor recommends that enterprise administrators use the following SharePoint command to limit file downloads:

# SharePoint
Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true

#
Set-Label -Identity <label> -AdvancedSettings @{BlockDownloadPolicy="true"}

Note: When this policy is enabled, users can only access files through the browser and cannot download, print, or sync.

Long-term strategic recommendations

• Minimize permissions: Limit the read and write scope of Microsoft Graph and reduce the sensitive data that the AI Agent can access.
• Skill File Review: Establish an enterprise-level Skill file review process and do not trust Skill files from external sources
• Behavior Monitoring: Monitor unapproved Teams/email automatic sending behavior
• Zero Trust AI: Treat AI Agent as an untrusted entity and all operations must be independently verified

Implications for AI developers and automation practitioners

This incident is a wake-up call to all practitioners who use AI Agents for automation. OpenAI's ChatGPT, Claude, DeepSeek and other models may become entry points for attacks in Agent mode. If you are building an automated pipeline with n8n, LangGraph, or Hermes Agent, be sure to add verification gates at every step—don’t give the AI ​​Agent the ability to automatically perform sensitive operations.

Internal link guidance

• Want to add security to your AI automation? Watch: How to add quality gates to your AI automation workflow: A practical guide from output to trustworthy results
• Real case: He uses AI code review + specification-driven development to earn over 10,000 yuan a month, achieving both safety and efficiency: He earns over 10,000 per month by relying on AI code review + specification-driven development: a practical review of a freelance developer
• Want to know about collaborative security solutions for team-level AI programming environments? See: How to use Runtime to build a team AI programming Agent collaboration environment: a 30-minute complete tutorial