Poisoning Copilot CoWork : Reworking Trust in AI Agents

Microsoft Copilot Cowork is an AI agent that acts as a personal assistant across Microsoft 365 ecosystem. It can schedule meetings, send emails, read documents, post content in Teams, and more. To extend its capabilities beyond Microsoft 365, Cowork supports skills and plugins. Skills are essentially instructions that tell Cowork how to perform specific tasks. Plugins on the other hand, can expose connectors to external services and data, which skills can then invoke as part of the actions, the Cowork agent is instructed to perform. But what happens when an attacker exploit the trust relationships surrounding the Cowork agent, and then turns those trusted capabilities against the user?

​

In this talk, we will walk through how a seemingly limited foothold in OneDrive can be used to poison Cowork skills, manipulating the instructions available to the Cowork agent and its capabilities to perform unauthorized actions it otherwise would not, and exfiltrate sensitive data. We will also look at how poisoned skills can leverage third-party connectors, how this affects the agent’s behavior, and where human approval fits into the attack chain.

​

The goal is to show how an attacker does not necessarily need direct access to the Cowork agent - controlling what the agent reads, trusts, and invokes, is enough to turn a limited compromise into a much more powerful attack.