A Copilot sandbox bypass discovered in Microsoft’s Copilot Cowork platform has sent enterprise security teams scrambling. Researchers found that a malicious Skill — a third-party extension installed inside Copilot Cowork — can break out of its intended isolation layer, phone home to an attacker-controlled server, and relay back any data the agent is able to reach. If your organisation relies on Copilot Cowork as part of its Microsoft 365 workflow, this affects you directly.
What Is the Copilot Cowork Sandbox Bypass?
Copilot Cowork lets users bolt extra capabilities onto Microsoft’s AI assistant through a Skills marketplace. Each Skill is supposed to run in a sandboxed environment — a walled-off execution layer that prevents it from touching resources outside its own scope. The sandbox exploit discovered by the PromptArmor Threat Intelligence Team shows that isolation was not actually enforced.
By installing a specifically crafted malicious Skill, an attacker can cause the Copilot agent to reach out to an external command-and-control server, receive instructions, execute them inside the Cowork environment, and then exfiltrate the results. The full attack chain requires no elevated privileges on the victim’s machine — the Skill itself is the attack vector.
According to PromptArmor’s detailed disclosure, the Skill was able to read commands from the attacker’s server and send back any data the Copilot agent could reach within the Microsoft 365 tenant — including files, emails, and calendar data accessible to the logged-in user.
How the Cowork Vulnerability Works Step by Step
Understanding the mechanics of this Cowork vulnerability makes it easier to assess your real exposure. The attack unfolds in four stages:
- Skill installation: A user — or an administrator with loose Skills governance — installs a malicious Skill from an online source. The Skill looks functional and legitimate on the surface.
- Sandbox escape: When the Copilot agent invokes the Skill, the Skill’s code makes outbound network requests to an attacker-controlled endpoint. The sandbox does not block this traffic.
- Command retrieval: The attacker’s server responds with instructions telling the Skill what to do next — enumerate files, read emails, query SharePoint, or exfiltrate documents.
- Data exfiltration: The Skill passes retrieved data back to the external server, entirely within what looks like normal AI agent activity on the network logs.
The stealth factor is significant. Because legitimate Skills also make outbound calls to external APIs, distinguishing malicious traffic from normal Skill behaviour is non-trivial without dedicated AI-layer monitoring.
Who Is Affected by This Copilot Security Flaw?
This Copilot security flaw targets any organisation running Microsoft Copilot Cowork with Skills enabled. That encompasses a wide range of Microsoft 365 commercial tenants — particularly those that have opened up the Skills marketplace without a strict allowlist policy. Individual consumers using the free or personal tier of Microsoft Copilot are not directly exposed, since Copilot Cowork is an enterprise-focused deployment.
The risk is highest for organisations where:
- Skills installation is not restricted to admin-approved sources
- Copilot agents have broad access to SharePoint, OneDrive, Exchange, or Teams data
- Network egress from the Microsoft 365 tenant is not filtered or monitored at the application layer
- There is no AI-specific security tooling logging Copilot agent actions
It is also worth noting that this is not an isolated incident. In June 2025, researchers disclosed EchoLeak (CVE-2025-32711), a zero-click prompt injection flaw in Microsoft 365 Copilot that allowed sensitive organisational data to be stolen without any user interaction. The Copilot Cowork sandbox bypass represents a separate but thematically linked class of attack: both demonstrate that AI agents operating with broad data permissions introduce an attack surface that traditional endpoint security tools were never designed to cover.
Microsoft’s Response and Fix Timeline
At the time of PromptArmor’s disclosure, Microsoft acknowledged the finding and indicated that a fix was in progress. As with many cloud-side vulnerabilities in Microsoft 365, the remediation is expected to arrive as a server-side update — meaning end users and administrators would not need to apply a local patch. However, no specific Patch Tuesday date was publicly committed to at the point of original disclosure.
Organisations should not wait for a patch before acting. The interim mitigations below reduce exposure immediately while Microsoft finalises its fix. For the latest patching status, monitor the Microsoft Security Response Center (MSRC) and subscribe to advisories for Microsoft 365 Copilot.
It is also worth reading the broader Microsoft Security Blog post on how prompt injection in AI agent frameworks can escalate to remote code execution — published in May 2026 — which signals that Microsoft’s own security team now treats this class of vulnerability as a priority research area.
Immediate Steps to Reduce Your Sandbox Exploit Risk
You can meaningfully reduce your exposure to this sandbox exploit right now, before any official patch lands. Work through these actions in order of priority:
- Audit installed Skills immediately. Open the Copilot Cowork admin centre and review every Skill currently installed across your tenant. Remove any that were not explicitly vetted by your security team.
- Restrict Skills installation to admins only. Prevent end users from self-installing Skills from the public marketplace. Require security review before any new Skill is approved.
- Apply least-privilege permissions to Copilot agents. Copilot agents inherit the permissions of the signed-in user. If those users have read access to the entire SharePoint estate, so does any malicious Skill they trigger. Scope access down aggressively.
- Enable egress monitoring for Microsoft 365 workloads. Log and alert on outbound calls from Copilot agent sessions to unexpected external domains. Several CASB and SIEM platforms now include Copilot-specific telemetry.
- Train users on third-party Skill risks. Employees should understand that Skills are code that runs with their identity and permissions — not harmless plugins. Phishing campaigns are already known to weaponise software installation as an initial access vector.
- Review Copilot’s data scope. If Copilot Cowork does not need access to sensitive SharePoint libraries, Exchange mailboxes, or Teams channels, remove that access now via Microsoft Entra ID permission scopes.
Why the Copilot Sandbox Bypass Is a Broader AI Security Warning
The Copilot sandbox bypass matters beyond its immediate technical scope because it illustrates a pattern that will repeat across every enterprise AI platform that supports extensibility. The moment you allow third-party code — whether called a Skill, a Plugin, a Tool, or an Extension — to execute inside an AI agent that holds user-level permissions to corporate data, you have created a supply chain risk. Traditional antivirus and endpoint detection tools do not scan AI agent actions. Traditional DLP tools do not inspect the payloads flowing between a Copilot agent and an external API endpoint.
This is why AI-native security tooling is no longer optional for organisations running Copilot at scale. It is also why understanding how Microsoft funds and evolves its AI infrastructure matters — decisions made at the infrastructure layer directly influence how quickly security mitigations can be deployed. For more on that dynamic, see our analysis of AI model infrastructure costs and how they shape Microsoft Copilot.
For enterprise teams running Windows environments alongside Copilot, layering good endpoint hygiene is still foundational. The recent Windows Defender RoguePlanet zero-day showed that AI-layer vulnerabilities and OS-layer vulnerabilities can exist simultaneously — and attackers chain them. Treating each vulnerability in isolation is no longer sufficient.
Frequently Asked Questions
What exactly is a Copilot Cowork Skill?
A Skill in Microsoft Copilot Cowork is a code-based extension — similar in concept to a browser extension or an app plug-in — that adds new capabilities to the Copilot AI agent. Skills can integrate external services, automate tasks, or extend what the agent can do inside Microsoft 365. Because they run with the permissions of the installing user, a malicious Skill can access whatever that user can access.
Do I need to be a large enterprise to be at risk from this Cowork vulnerability?
No. Any organisation with a Microsoft 365 commercial licence that has Copilot Cowork enabled and has installed Skills from external sources is potentially exposed. Even a small business with a handful of Microsoft 365 users could be targeted if a malicious Skill is in circulation. The key risk multiplier is how broadly the affected user’s account can access company data.
Has Microsoft confirmed a patch date for this Copilot security flaw?
As of the time of writing, Microsoft has acknowledged the vulnerability and is working on a server-side fix, but has not publicly committed to a specific release date. Cloud-side fixes for Microsoft 365 typically do not require user action and deploy automatically once released. Monitor the Microsoft Security Response Center (MSRC) for the latest advisory updates.
Will my antivirus or Windows Defender catch this attack?
Traditional endpoint security tools, including Windows Defender, are not designed to inspect the behaviour of AI agent sessions or the payloads passed between Copilot agents and external APIs. They will not reliably detect this sandbox exploit. You need AI-layer or CASB-level monitoring to catch this class of attack in practice.
Is the free version of Microsoft Copilot also vulnerable?
The vulnerability is specific to Microsoft Copilot Cowork, which is an enterprise-focused feature. The consumer-facing Copilot experience does not expose the same Skills marketplace in the same way, so typical home users are not directly exposed to this particular attack vector. Enterprise deployments with Copilot Cowork and Skills enabled are the primary concern.
