Microsoft Copilot Cowork Exfiltrates Files

The specific attack vector here matters: the vulnerability reportedly allowed exfiltration through rendered images inside email messages, meaning the agent's legitimate rendering capability became the data channel. That's not a misconfiguration, it's the intended feature being weaponized.

This is largely disconnected from recent activity in our archive, as we have no prior coverage to anchor it to. It does, however, belong to a well-documented pattern in the broader security research community: agentic systems that can read, compose, and send communications are structurally difficult to sandbox because the output channel is also the work product. The tension isn't unique to Microsoft. Any agent with write access to external communications faces the same class of problem, and the industry has not converged on a standard mitigation approach. Until agent frameworks ship with explicit, auditable permission scopes that users can inspect before deployment, incidents like this are a predictable consequence of the architecture rather than an edge case.

Watch whether Microsoft publishes a specific architectural change to Copilot Cowork's email permissions model within the next 60 days. A vague patch note signals a surface fix; a documented permission boundary redesign would indicate they are treating this as a structural problem.