Microsoft Copilot Cowork Controlled by Attacker, Bypassing Sandbox

Context

Microsoft Copilot Cowork is an agent in M365 that operates with the permissions of the active user, retrieving and acting on data from Outlook, Teams, SharePoint, connected plugins, and more.

The agent runs in a sandbox, which is intended to block network access and prevent the agent from running code that reaches any untrusted services.

A vulnerability was identified that bypassed the sandbox to make untrusted network requests. This meant that when Copilot was manipulated by a prompt injection or ran code from a Skill the user found online and uploaded, that code could communicate with attacker servers.

We show that this made it possible for attackers to establish a command and control loop: the attacker server supplies commands, the commands are executed in the sandbox, and the results are sent back to the attacker. What’s worse, the user clicking the stop button doesn’t help.

This enabled the attacker to execute commands to exfiltrate any data from the sandbox or its connected services, such as emails from Outlook, files from SharePoint, data from plugins, session chat history, and more.

This vulnerability was reported to Microsoft on June 24, 2026, and has been mitigated as of August 19, 2026. More details on responsible disclosure are at the bottom of the article.

The Attack Chain

Note: Technical details of the network bypass and malicious Skill code are discussed after the attack chain.

1. 1.

   The victim makes a benign query to Copilot Cowork

   Here, the agent is asked to compare two documents for any inconsistent claims.

   

2. 2.

   The victim is using a Skill found online that contains malicious code

   To perform the comparison, the user asks the agent to invoke a ‘doc-consistency’ Skill. Skills are frequently found online and uploaded by users, and they can also be shared intra-org within M365. Per the documentation, “Skills can also include up to 20 companion files (such as reference documents and scripts)”. One script bundled with this Skill is malicious.

   

3. 3.

   Copilot Cowork runs the malicious code

   The agent decides to execute the Skill’s bundled scripts. The script generates a full document consistency report, but it also initiates an exploit.

   

4. 4.

   The malicious code bypasses the sandbox network restrictions to retrieve commands from an attacker’s server, execute them, and send the results back to the attacker

   

5. 5.

   The attacker runs whatever commands they want to exfiltrate data from Outlook, SharePoint, Teams, connected plugins, chat history, and more

   Even if the user clicks the stop button, the attack can continue. Processes running in the background in the sandbox continue to execute even when an agent’s turn ends.

   

   Note: Copilot Cowork accesses services such as Outlook, SharePoint, Microsoft Graph, plugins, and more via an MCP server. The attacker can programmatically access this MCP server with a command. Here, the attacker’s server has a function that turns terminal inputs like ‘MCP Outlook ListMessages’ into commands containing inline Python scripts that call the MCP server.

Technical Vulnerability Details

Copilot Cowork uses file storage outside the sandbox for a variety of purposes; for example, to output a file to the user. To support this, there is a service that syncs files between the storage and the sandbox. The service, which lives outside the sandbox, accepts a URL for the file it is syncing to storage.

This research discovered that an attacker’s script can hijack this service to make network requests by invoking the service with URLs of their choosing.

This has two effects:

1. 1.
   The attacker’s server can reply with a file containing commands to be run in the sandbox. The malicious script in the Skill then immediately reads and executes these commands.
2. 2.
   The results from commands executed in the sandbox can be transmitted back to the attacker’s server by sending another ‘request’, this time containing the command output in the requested URL: attacker.com/?data=result-from-command.

The attacker can read these ‘requests’ to their server to view the command output and help determine which command they want to send next.

Malicious code in the Skill retrieves a command file from the attacker’s server every couple of seconds.

The attacker could then send commands that do many things, for example:

• ■
  Explore the victim’s data
• ■
  Deploy more malware to establish persistent access
• ■
  Escalate permissions
• ■
  Clean up evidence by deleting the malicious script that gave them access

Responsible Disclosure

This vulnerability was reported to Microsoft on June 24, 2026. On August 19, 2026, Microsoft confirmed that the issue had been mitigated.

Timeline