Copilot Cowork

A penetration tester exfiltrated a company's confidential files by sending a single email that required no user interaction, no malware, and no link clicks. Microsoft Copilot, acting on the email, str…

Microsoft Copilot Cowork, a Microsoft 365 feature, is vulnerable to file exfiltration attacks through indirect prompt injection, as it automatically approves actions like sending emails and Teams mess…