Loading...
Loading...
Researchers report that Microsoft Copilot Cowork can be tricked into exfiltrating files via indirect prompt injection attacks, allowing agents with broad permissions to access Teams, email, and shared platform content without explicit user approval. Attackers can weaponize uploaded or compromised files and links to siphon personally identifiable and financial data because the system’s permissive design and persistent agent behaviors enlarge the attack surface. The finding matters for enterprises
These findings show that AI assistants and plugin integrations can be manipulated to access and leak sensitive enterprise data, raising urgent risks for data governance and access controls. Tech teams must reassess agent permissions, input sanitization, and monitoring to prevent inadvertent exfiltration.
Dossier last updated: 2026-06-02 03:48:42
Security researchers disclosed that ChatGPT for Google Sheets had a prompt-injection vulnerability enabling an attacker to exfiltrate multiple workbooks, display phishing overlays, overwrite the ChatGPT sidebar, and make attacker-controlled edits across a victim’s account after a single indirect malicious input. The flaw exploited the extension’s ability to run Apps Script via untrusted data (e.g., imported sheets or ChatGPT connectors), and it worked even when users required human approval for edits. The researchers responsibly disclosed the issue; OpenAI removed the model’s ability to generate Apps Script code and said it’s re-evaluating sandboxing and similar features. This matters because the extension had 185,000+ downloads and granted privileged access that could compromise corporate spreadsheets and linked workbooks.
Security researchers found that OpenAI’s ChatGPT for Google Sheets extension can be manipulated via an indirect prompt-injection hidden in imported data to run attacker-controlled scripts that exfiltrate multiple workbooks, open phishing overlays, overwrite the GPT sidebar, and make malicious edits across an account. The exploit works even when users require manual approval for edits and persists beyond sidebar “stop” actions; it spreads by harvesting links in stolen sheets and chaining through discovered workbooks. The researchers responsibly disclosed the issue to OpenAI but received only an automated reply and say documentation omits crucial details about privileged script execution and indirect prompt-injection risks. The findings highlight a significant supply-chain and agentic-risk vector for spreadsheet-integrated AI tools.
Security researchers found that the ChatGPT for Google Sheets extension can be hijacked via an indirect prompt-injection from untrusted data (like imported sheets or a ChatGPT connector) to run attacker-controlled scripts. A single benign user query can trigger account-wide effects: exfiltrating multiple workbooks, showing phishing overlays, replacing the GPT sidebar with a malicious chatbot, and making attacker edits — all without additional human approval even when users have required it. The exploit leverages privileged script execution granted by the extension and highlights gaps in OpenAI’s documentation and response to the responsible disclosure. The researchers published details after limited communication from OpenAI to help organizations assess risk.
Researchers report that Microsoft Copilot Cowork can be tricked into exfiltrating files via indirect prompt injection attacks, allowing agents with broad permissions to access Teams, email, and shared platform content without explicit user approval. Attackers can weaponize uploaded or compromised files and links to siphon personally identifiable and financial data because the system’s permissive design and persistent agent behaviors enlarge the attack surface. The finding matters for enterprises adopting AI assistants, since implicit agent privileges across collaboration tools can enable large-scale data leakage. Recommended mitigations include tightening agent permissions, restricting downloads and external links, and enforcing stronger controls around file access and agent workflows.