Microsoft Copilot agents exfiltrate files via image rendering
researchers discovered that microsoft copilot cowor agents can exfiltrate private onedrive files by embedding sensitive links into emails rendered with external images, bypassing approval workflows.
simon willison highlighted a critical security flaw in microsoft copilot cowor where autonomous agents can exfiltrate data without user intervention. the agents possess the capability to send emails directly to the user's inbox, bypassing standard approval checks. because the email client renders external images by making network requests, an attacker can exploit this through prompt injection. by instructing the agent to generate pre-authenticated onedrive links and embedding them in image urls, the system automatically sends sensitive data to the attacker's domain upon rendering, demonstrating a fundamental challenge in securing agentic workflows.