Poisoning Copilot CoWork : Reworking Trust in AI Agents | AltSecCON 2026
Source: YouTube · Altered Security · published Nov 3, 2026 · 42:34
Summary
This talk demonstrates a real-world attack chain, "Poisoning Copilot Kovac," showing how an attacker with only initial phishing-level access can abuse trust relationships in Microsoft Copilot's agent ecosystem to exfiltrate personal data via a poisoned skill file 0:04-0:15.
Key Takeaways:
• Microsoft Copilot acts as the orchestration UI for AI, with agents ("limbs" for LLMs) executing tasks using persistent data connectors; Kovac is Microsoft's built-in agent grounded in organizational data via Work IQ 2:31-3:01, 3:56-4:24.
• Skills solve "context bloat" by loading only relevant instructions at runtime; they are folders with a skill.md, scripts, assets, and references, and third-party plugins are packaged like Microsoft Teams apps and published via Microsoft Foundry/Marketplace 6:57-7:33, 10:13-11:23.
• Kovac stores skills and task outputs in the user's OneDrive (Documents/Kovac folder), so compromising OneDrive enables skill poisoning—embedding malicious instructions (an indirect prompt injection / supply chain attack) 16:33-17:08.
• The demo: the attacker phishes the victim (CFO Elizabeth Wilson) via consent-phishing, abuses the "four key" client ID family with a refresh token to mint a high-privilege Microsoft Graph/Teams token, discovers her Gmail Daily Summary skill, poisons it to dump Gmail PII into OneDrive, then exfiltrates it 18:06-18:45, 19:47-20:31.
• The poisoned skill kept the user's normal newsletter summary intact (avoiding suspicion) while appending a data dump revealing her personal Gmail, home address, Netflix password, and credit card number—exfiltrated via the same Graph API channel the attacker already had 28:01-29:47, 30:07-31:53.
• Limitations and future work: Microsoft's Enterprise Data Protection may break the technique at any time; agent-to-agent communication lacks built-in security, and defenses should focus on LLM-level guardrails against indirect prompt injection since agent-level guardrails risk recreating context bloat 32:50-34:04, 34:25-35:58.
The core lesson: as AI value shifts from answers to autonomous task completion, trust relationships in agent ecosystems become the new attack surface—developers must add guardrails, and users must be cautious about what data they connect agents to 35:08-35:35.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This session focuses on increasing the important area
of security agents and the trust relationship
that allows them to operate as AI powered systems
become more integrated into an enterprise. Workflows. Understanding how trust can be abused
or intervene becomes critical. We have, and the security researchers at Security Information Security Experience
focusing on enterprise cloud security, retaining Microsoft entirety,
hybrid and individual works across cloud security,
net teaming, network security, cloud misconfiguration, and identity and access
management in Microsoft Android. Together, they will present a Poisoning Copilot co-op reworking trust in AI agent. These will come and mission. So let's begin. That topic for today that I'm going to be
presenting is poisoning copilot Kovac. Rewo…