Data Exfiltration

Microsoft Copilot Cowork allows agents to send emails to users' inboxes without approval, potentially leaking data to attackers via rendered images or OneDrive download links. This vulnerability enables attackers to exfiltrate data by opening compromised messages or downloading files through pre-authenticated links.