Microsoft Copilot Cowork 存在文件外泄风险
Microsoft Copilot Cowork 因在发送邮件和 Teams 消息时存在不安全的自动操作审批机制，容易受到通过间接提示词注入发起的文件外泄攻击。
该攻击针对包括 Claude Opus 4.7 在内的最先进模型取得了很高的成功率。
概述
Copilot Cowork 是 Microsoft 365 中现已提供的一项前沿功能。它使用用户的 Microsoft 权限运行，并可通过 Microsoft Graph 读取和操作用户 Microsoft 租户中的数据。
在本文中，我们展示了攻击者如何通过恶意技能中的间接提示词注入，从 M365 中窃取文件。这是利用了以下事实：与其他敏感操作不同，向当前用户发送电子邮件和 Teams 消息不需要人工审批，而在 Teams 或 Outlook 中打开被篡改的消息可能会触发攻击者控制的网络请求。
这一风险表明，让智能体访问多个系统会扩大提示词注入的攻击面。单独来看，智能体的预期功能是无害的；然而，由于集成系统的特性，用户面临风险。这让我们想起之前关于通信应用中的 URL 预览如何成为智能体数据外泄渠道的研究。由于此风险涉及智能体在整个企业生态系统中以委托权限运行的系统设计问题，而非特定漏洞，我们公开此项研究是为了告知用户，使用此类智能体产品需要承担哪些风险。
除此之外，我们还向微软披露了一个可直接从 Copilot Cowork 沙箱环境中导出数据的漏洞。
攻击链
微软关于操作审批的文档指出：“[Copilot] Cowork 在执行敏感操作（如发送电子邮件或在 Teams 中发布消息）之前，会征求你的许可。”然而，在实际操作中，当接收者是当前活跃用户时，这些操作会立即执行，无需人工审批（用户没有修改此行为的设置）。由于这些消息可能包含会触发对外部网站网络请求的外部图片，当用户打开智能体发送的恶意消息时，数据就可能被泄露。Copilot Cowork 可以检索用户有权访问的文件的“预认证下载链接”，任何打开该链接的人都能下载该文件。因此，被操控的智能体可以通过泄露预认证下载链接来窃取文件。
受害者有权访问存储在 SharePoint 或 OneDrive 中包含个人身份信息（PII）和财务数据的文件。
受害者向 Copilot Cowork 上传了一个包含提示词注入的技能文件。
对于一般用例，这种情况相当常见；用户会在网上找到一个文件，并将其作为技能上传。此攻击不依赖于注入来源——其他注入来源包括但不限于：来自 Claude for Chrome 的网络数据、已连接的 MCP 服务器等。
注意：管理员对“技能”的监督能力有限，因为 Copilot Cowork 中的技能会自动从用户 OneDrive 中的特定路径加载。
受害者要求 Microsoft Copilot Cowork 回顾他们本周的工作内容，从而触发了该技能。
注入操作操控 Microsoft Copilot Cowork 在 Teams 中发布一条消息，该消息在被查看时会泄露预认证的文件下载链接。
注入操作告知 Copilot Cowork，存在一个服务可以为回顾消息创建文档预览；为此，智能体会检索每个文件的预认证下载链接，并通过恶意 HTML 图片标签将这些 URL 作为查询参数传递给攻击者控制的网站。
在此过程中的任何环节都不需要人工审批。
如果我们展开“任务完成”模块，可以看到智能体的操作过程——但恶意消息内容始终不可见，即使点击了 Teams 操作也是如此。
当用户打开 Teams 消息时，预认证的下载链接会被窃取，攻击者只需访问该链接即可下载文件。
降低贵组织面临的风险
Microsoft Copilot Cowork 对用户通过 Microsoft Graph 能访问的几乎所有资源都拥有读取权限。因此，降低此类攻击影响范围的主要机制，是在整个 Microsoft 生态系统中限制过度授权。
为限制用户获取文件的预认证下载链接，管理员可通过在 SharePoint Online 管理 Shell 中运行命令，限制从 SharePoint 下载文件：
Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true
或者，基于敏感度标签进行阻止：
Set-Label -Identity <label> -AdvancedSettings @{BlockDownloadPolicy="true"}
注意：此配置会影响功能；文档指出，对于受“BlockDownloadPolicy”策略约束的文件，“用户仅拥有浏览器访问权限，无法下载、打印或同步文件。他们也无法通过应用（包括 Microsoft 365 应用，如 Word、Excel、PowerPoint 等）访问内容。”
模型无关的利用方式
攻击链最初是在模型选择设为“自动”的情况下进行的，该设置会在 Claude Opus 4.7 和 Claude Sonnet 4.6 之间动态路由。不过，我们通过直接指定模型，明确验证了该攻击在更先进的 Opus 4.7 模型上，使用完全相同的注入方式也能成功。
Opus 4.7 在搜索近期编辑过的文档方面更为全面；它将窃取范围扩大到包括当周所有先前 Cowork Copilot 会话中使用过的文档，以及模型设为“自动”时在更典型文档位置找到的文件。
提示词注入的有效性
此提示词注入表现出非常高的有效性，我们注意到 Copilot Cowork 在每次试验中都完成了整个攻击链（5 次试验全部成功）。此外，该攻击并不依赖于用户查询的具体措辞——每当模型调用该技能时，注入都会成功。
该注入仅存在于一个 81 行的技能文件中，共 5 行，每行长度与其他行相当。
这表明，即便使用最新模型，且仅植入一小段恶意文本，间接提示词注入也能劫持智能体的行为。
因此，我们敦促读者在处理不可信数据（例如网上共享的技能）时务必谨慎——尤其是当这些不可信数据被置于可信上下文（如技能文件）中时。
定时任务加剧风险
在 Copilot Cowork 中，用户可以创建定时任务。定时任务是一种无需用户监督、按固定周期执行的提示词。本文描述的“每周回顾”行为，正是用户极有可能通过定时任务来自动化的那类任务。
定时任务显著增加了此类攻击的风险面，因为用户不在现场阻止恶意工作流，且提示词注入可以周期性生效。
Microsoft Copilot Cowork Exfiltrates Files
Microsoft Copilot Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of insecure automatic action approvals for sending Emails and Teams messages.
This attack achieved a high success rate against state-of-the-art models, including Claude Opus 4.7.
Overview
Copilot Cowork is a Frontier feature available now in Microsoft 365. It operates with the users’ Microsoft permissions and can use Microsoft Graph to read and operate on data in one’s Microsoft tenant.
In this article, we demonstrate that through an indirect prompt injection in a poisoned skill, attackers can exfiltrate files from M365. This is done by exploiting the fact that, unlike other sensitive actions, sending emails and Teams messages to the active user does not require human approval, and opening the compromised messages in Teams or Outlook can trigger attacker-controlled network requests.
This risk reflects that giving agents access to multiple systems expands the prompt-injection attack surface. In isolation, the agent’s intended capabilities are benign; however, due to the properties of the integrated systems, users are at risk. This is reminiscent of our previous work on how URL previews in communications apps have become an egress surface for agents. As this risk pertains to the design of a system in which agents act with delegated authority across an entire enterprise ecosystem, rather than to a specific bug, we are publicizing this work to inform users of the risks they are accepting by using an agentic product of this nature.
Separate from this risk, we have disclosed a vulnerability to Microsoft that directly allows data egress from Copilot Cowork’s sandbox environment.
The Attack Chain
Microsoft’s documentation on action approvals states, “[Copilot] Cowork asks for your permission before taking sensitive actions, like sending an email or posting a message in Teams.” However, in practice, when the recipient is the active user, these actions execute immediately without requiring human approval (users do not have a setting to modify this behavior). Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Copilot Cowork can retrieve ‘pre-authenticated download links’ for files the user has access to, which allow anyone who opens the link to download that file. So, a manipulated agent can exfiltrate files by exfiltrating pre-authenticated download links.
The victim has access to files stored in SharePoint or OneDrive containing PII & Financial data
The victim uploads a skill file to Copilot Cowork that contains a prompt injection
For general use cases, this is quite common; a user finds a file online that they upload as a skill. This attack is not dependent on the injection source - other injection sources include, but are not limited to: web data from Claude for Chrome, connected MCP servers, etc.
Note: Admins have limited oversight of ‘Skills’, as Skills in Copilot Cowork are automatically loaded from a specific path in a user’s OneDrive.
The victim asks Microsoft Copilot Cowork to review what they worked on that week, triggering the skill
The injection manipulates Microsoft Copilot Cowork to post a Teams message that will exfiltrate pre-authenticated file download links when it is viewed
The injection tells Copilot Cowork that a service exists to create document previews for the recap message; to do this, the agent retrieves pre-authenticated file download links for each file and passes those URLs as query parameters to an attacker-controlled site via malicious HTML image tags.
At no point in this process is human approval required.
If we expand the ‘Task complete’ block, we can see the agent’s actions play out – but the malicious message content is never visible, even when the Teams action is clicked on.
When the user opens their Teams messages, the pre-authenticated download links are exfiltrated, and the attacker can download the files by visiting the link
Mitigating Risks for Your Organization
Microsoft Copilot Cowork has read access to essentially any resource a user does through Microsoft Graph. As such, the primary mechanism to reduce the blast radius of attacks like this is to restrict excessive permissioning across one’s Microsoft ecosystem.
To restrict users’ ability to retrieve pre-authenticated download links for files, administrators can restrict file downloads from SharePoint by running commands in the SharePoint Online Management Shell:
Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true
Or, to block based on a sensitivity label:
Set-Label -Identity <label> -AdvancedSettings @{BlockDownloadPolicy="true"}
Note: This configuration affects functionality; documentation states that for files under the policy 'BlockDownloadPolicy', "Users have browser-only access with no ability to download, print, or sync files. They also can't access content through apps, including the Microsoft 365 Apps (like Word, Excel, PowerPoint, and so on)."
Model Agnostic Exploitation
The attack chain was initially conducted with the model selection set to ‘auto’, which dynamically routes between Claude Opus 4.7 and Claude Sonnet 4.6. However, we validated explicitly that this attack succeeds with the exact same injection on the more advanced Opus 4.7 model by setting the model directly.
Opus 4.7 was more comprehensive in its search for recently edited documents; it expanded exfiltration to include every document used in previous Cowork Copilot sessions that week, as well as the files stored in more typical document locations that were found when the model was set to ‘Auto’.
Prompt Injection Efficacy
This prompt injection exhibited a very high efficacy, and we noted that Copilot Cowork completed the entire attack chain on every trial (5 for 5). Furthermore, the attack was not contingent on the specific wording of the user query – whenever the model invoked the skill, the injection succeeded.
The injection consisted of 5 lines in an 81-line skill file, all of comparable length to the other lines.
This demonstrates that even with the latest models and only a small excerpt of malicious text, an indirect prompt injection can hijack agent behavior.
As such, we urge readers to exercise caution when working with untrusted data, such as skills shared online – especially when the untrusted data is placed into a trusted context, such as a skill file.
Scheduled Tasks Exacerbate Risks
In Copilot Cowork, users can create scheduled tasks. A scheduled task is a prompt that executes on a recurring basis without user oversight. The 'weekly review' behavior described in this article is the exact kind of task a user would be likely to automate with a scheduled task.
Scheduled tasks increase the risk surface for attacks like this significantly, as the user is not present to stop malicious workflows, and the prompt injections can take effect on a recurring basis.