TLDR Tech / InfoSec
Microsoft Copilot Cowork Exfiltrates Files
Microsoft Copilot Cowork lets agents send unapproved emails to a user's own inbox that render external images, so a prompt injection could exfiltrate data and leak pre-authenticated OneDrive download links to an attacker when the victim opens the message.
Read the full story