Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Copilot Cowork Exfiltrates Files

promptarmor.com

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Microsoft Copilot Cowork Exfiltrates Files

#21

Post by ares623 »

2001zhaozhao wrote: post #2

AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.

Thankfully inserting malicious skills is not something that can easily be done, you need to a lot of things wrong and the attacker to do a lot of things right in order for it to be exploited.

Re: Microsoft Copilot Cowork Exfiltrates Files

#22

Post by keyle »

pwarner wrote: post #15

MS rushed this to production, sure they call it a beta feature but it's clear it was super rushed. They're desperate to be relevant.

"Beta" in their world appears to be yolo-commit and mic drop.

The amount of brokenness in Teams never stops to astonish. It's that bad I think it's a psyop to nudge people back to the office.

Re: Microsoft Copilot Cowork Exfiltrates Files

#23

Post by datadrivenangel »

ares623 wrote: post #21
2001zhaozhao wrote: post #2

AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.

Thankfully inserting malicious skills is not something that can easily be done, you need to a lot of things wrong and the attacker to do a lot of things right in order for it to be exploited.

Basically everyone I know is installing almost random skills collections...

Re: Microsoft Copilot Cowork Exfiltrates Files

#24

Post by hennell »

pwarner wrote: post #15

MS rushed this to production, sure they call it a beta feature but it's clear it was super rushed. They're desperate to be relevant.

Didn't the first 365 copilot lauch have a whole rollback as they belateded realised the rag setup would often ignore file access and permissions, so queries like "List the highest paid members of x team sorted by salary" would just work etc?

The combo of rushing with a technology that isn't very easy to control, understand or securely limit is just mad to me.

Re: Microsoft Copilot Cowork Exfiltrates Files

#25

Post by mlacks »

Exfiltrates: to steal sensitive data from a computer system (for example, via a flash drive).

I'm not going to defend Microsoft here, but the title (at the source blog) is misleading and a bit rage-baity. What happened with Cowork may have been rushed, possibly due to incompetence, but incompetence is not malice. This framing is also recycled across a few of the author's other interesting findings.

Within the article, the wording is much more accurate: “The victim uploads a skill file to Copilot Cowork that contains a prompt injection,” and “The injection manipulates Microsoft Copilot Cowork into posting a Teams message that exfiltrates pre-authenticated file download links when viewed.”

Re: Microsoft Copilot Cowork Exfiltrates Files

#26

Post by lelandfe »

0gs wrote: post #10
2001zhaozhao wrote: post #2

AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.

i think people are probably already doing it. i made a skill scanner but it's also just easy to download a zip and inspect the contents... but people are loading these things remotely. i agree that it is easy to not install a pentester's magic skill, but the attack capabilities a skill can have are pretty insane. people should just make their own is my pov.

While debugging in Cursor a couple weeks ago, Opus 4.6 chirped it had discovered that my token, when base64 decoded, had a date that was in the past - perhaps expired?

And it was expired!

And I was happy. And some time passed - and I realized it had read my .env file and performed operations on my API keys.

That these models do all this stuff already makes me assume any skill take over is simply trivial.

Re: Microsoft Copilot Cowork Exfiltrates Files

#27

Post by AntosTools »

SpicyLemonZest wrote: post #13
2001zhaozhao wrote: post #2

AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.

Unlike plugins in traditional software, skills do not represent a carveout from any security boundary nor run with elevated trust. They're just selectively loaded context. Anything you can convince an agent to do with a skill you can convince it to do without one.

[dead]

Re: Microsoft Copilot Cowork Exfiltrates Files

#28

Post by codebje »

mlacks wrote: post #25

Exfiltrates: to steal sensitive data from a computer system (for example, via a flash drive). I'm not going to defend Microsoft here, but the title (at the source blog) is misleading and a bit rage-baity. What happened with Cowork may have been rushed, possibly due to incompetence, but incompetence is not malice. This framing is also recycled across a few of the author's other interesting findings. Within the article…

The malice is by the author of the malicious skill file.

This is an intrinsic risk associated with giving LLMs access to sensitive material. It's reckless of Microsoft to give an LLM such broad access based on the user's own permissions.

If there were a confirmation prompt for the Teams message, why would even a highly competent user refuse it? That's what the skill says it will do. The message is expected, the visible content is expected, a confirmation prompt is just a nuisance.

Post reply on HN