PromptArmor: malicious Skills could hijack Microsoft Copilot Cowork’s AI gateway to exfiltrate files; remediated by Sept. 2, per PromptArmor
Security firm PromptArmor says Microsoft 365 Copilot Cowork is meant to run in a sandbox that blocks outbound network access, but malicious Skills could hijack its AI gateway to Anthropic, spawn cloud agents with network tools, and send user files to an attacker’s server; it disclosed the issue to Microsoft on July 14, 2026, and says it was fixed by September 2.
PromptArmor says Copilot Cowork is an agent in Microsoft 365 whose sandbox is intended to block network access and stop the agent from running code that reaches untrusted services. To generate replies, though, the sandbox forwarded network requests to Anthropic; malicious Skills could hijack that path, spawn new agents in Anthropic’s cloud with network-capable tools, and send data to an attacker’s server. No step-by-step human approval was required, and the attack could reach any data Copilot could access—uploaded files, SharePoint, Teams, Outlook and more.
In the demo path, a user uploads a sensitive contract and invokes a “contract review” Skill found online; Skills may bundle up to 20 companion files including scripts. A malicious description claims all processing stays on-device with no document content sent to third parties; after a cursory look, Copilot treats the script as a safe local analyzer and runs it. The script then hunts user data, exploits a flaw to spawn agents outside the sandbox, and uses the same AI gateway Copilot uses so each cloud agent web-fetches an attacker URL with contract fragments in the query string. The attacker’s server logs reassemble the contract.
PromptArmor says it disclosed the issue to Microsoft on July 14, 2026, and that it was remediated as of September 2, 2026. Microsoft Learn’s Cowork documentation confirms users can create custom Skills and that each Skill may include up to 20 companion files such as reference documents and scripts. This site did not independently reproduce the bug; whether variants remain should follow later vendor advisories.
Sources
- Hijacking Copilot Cowork's AI Gateway to Bypass Sandboxing and Exfiltrate Files — PromptArmor：Threat Intelligence
- Use Copilot Cowork — learn.microsoft.com