Security flaw allows attackers to steal OneDrive files through prompt injection and automated email messages with malicious images.
- Microsoft Copilot Cowork sends emails to users’ inboxes without approval, creating security risk
- External images in agent-generated emails can trigger network requests to attacker-controlled sites
- Prompt injection attacks can leak OneDrive pre-authenticated download links to steal files
A security vulnerability in Microsoft Copilot Cowork allows attackers to exfiltrate data from corporate OneDrive accounts through a combination of prompt injection and automated email functionality.
The flaw centres on Copilot Cowork’s ability to send emails to users’ own inboxes without requiring approval. When the AI agent generates these messages, they can contain external images that trigger network requests to attacker-controlled websites.
The attack works by exploiting how OneDrive creates pre-authenticated download links. Through prompt injection techniques, attackers can manipulate the AI agent to include these sensitive links in automatically generated emails. When users open the compromised messages, external images load and transmit the download URLs to malicious servers.
This gives attackers direct access to corporate files without requiring additional authentication. The vulnerability represents what security researchers call a “lethal trifecta” – combining AI prompt injection, automated email capabilities, and pre-authenticated file sharing links.
The issue highlights ongoing challenges in securing agentic AI systems that can perform actions on behalf of users. Unlike traditional applications with fixed functionality, AI agents can be manipulated through carefully crafted prompts to behave in unintended ways.
Microsoft has not yet publicly responded to reports of the vulnerability. The timing is particularly sensitive as organisations increasingly deploy AI assistants with expanded permissions across corporate environments.
Why It Matters
This vulnerability demonstrates critical risks in AI agent deployments that CISOs must address before widespread enterprise adoption. The combination of automated actions, external communications, and file access permissions creates significant data loss exposure that traditional security controls may not detect.
For board reporting, this incident illustrates how AI productivity tools can introduce novel attack vectors that bypass established data loss prevention measures, requiring updated security frameworks and risk assessments.
What To Do Now
- Review AI agent permissions and restrict automated email capabilities until security controls are verified
- Implement monitoring for unusual OneDrive link generation and external image requests from corporate email
- Assess current prompt injection protections across all deployed AI systems
- Update data classification policies to account for AI-mediated data sharing risks
