Security research firm PromptArmor disclosed that Microsoft 365 Copilot Cowork is vulnerable to file exfiltration via indirect prompt injection, stemming from insecure automatic approval of the agent’s ability to send emails and Teams messages. In the demonstrated attack, a user uploads a malicious skill file whose hidden instructions direct the agent to read files from SharePoint and OneDrive and exfiltrate them through an email or Teams message sent without requiring human approval. Researchers reported a high success rate against the production agent; Microsoft said Cowork operates within a user’s existing permissions and displays approval dialogs for other sensitive operations, but the flagged send-message actions were not gated at the time of disclosure. No confirmed real-world exploitation of the flaw was reported.