[flagged]
Microsoft Copilot Cowork Exfiltrates Files
11–20 of 58 posts
Re: Microsoft Copilot Cowork Exfiltrates Files
#12A skill is just a program for an LLM agent. This just seems like works-as-expected. Are the five lines in the skill notably innocuous or something? I don't mean to dismiss it out of hand but I don't understand what happened here because it seems to read "`curl $url | bash` can exfiltrate data" which seems pretty straightforward that it can.
Re: Microsoft Copilot Cowork Exfiltrates Files
#13AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.
Unlike plugins in traditional software, skills do not represent a carveout from any security boundary nor run with elevated trust. They're just selectively loaded context. Anything you can convince an agent to do with a skill you can convince it to do without one.
Re: Microsoft Copilot Cowork Exfiltrates Files
#14Nice find. We're PoCing Cowork and I've personally been impressed with it so far, but it seems we'll have to wait with a wider rollout until Microoft give us more admin feature to turn off what users can do with it.
> Note: Admins have limited oversight of ‘Skills’, as Skills in Copilot Cowork are automatically loaded from a specific path in a user’s OneDrive.
I feel this part is a bit disingenuous. We have full control over the sharepoint containers which house users personal onedrives. We actively scan them and prevent a lot of files from getting in them. That being said, it's still a fair point, because a "skill" could basically be a text file.
Re: Microsoft Copilot Cowork Exfiltrates Files
#15MS rushed this to production, sure they call it a beta feature but it's clear it was super rushed.
They're desperate to be relevant.
Re: Microsoft Copilot Cowork Exfiltrates Files
#16AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.
If this can be exploited via a skill, then it can be exploited via untrusted input inserted into context. Does Cowork help with reading email?
Re: Microsoft Copilot Cowork Exfiltrates Files
#17Ah yes, hackers capitalizing on human's laziness. Always ggwp.
Re: Microsoft Copilot Cowork Exfiltrates Files
#18Ah yes, hackers capitalizing on human's laziness. Always ggwp.
But maybe we can like invent a program that will avoid the consequences of laziness while allowing us the benefits of the shortcuts!
Here's my repo for running copilot in a vm
github.com/gokuvegeta894/node-copilot-vm
(Fake link, if someone typosquats the above link and it exists, assume it's malware)
Re: Microsoft Copilot Cowork Exfiltrates Files
#19AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.
Only if it has access to exfiltrate data. We deny by default and the company has to allowlist each individual destination.
Re: Microsoft Copilot Cowork Exfiltrates Files
#20A skill is just a program for an LLM agent. This just seems like works-as-expected. Are the five lines in the skill notably innocuous or something? I don't mean to dismiss it out of hand but I don't understand what happened here because it seems to read "`curl $url | bash` can exfiltrate data" which seems pretty straightforward that it can.
A skill is just instructions that the agent can autonomously copy into context. There’s no trust boundary between trusted and untrusted context.