Disclosed vulnerability
Microsoft ships Copilot Actions on Windows 11 off-by-default, documenting that cross-prompt injection can cause data exfiltration or malware installation
AIR-2025-0175 AIR record · 2025-11-microsoft-copilot-actions-windows-xpia
From the supporting source
agentic AI applications introduce novel security risks, such as cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions, leading to unintended actions like data exfiltration or malware installation.learn.microsoft.com
The record
Disclosed
2025-11-13
Vendor
Microsoft
Product
Copilot Actions on Windows 11 / agent workspace
Risk domain
Privacy › Data exfiltration channels
System type
Generative model
Who acted
Agent acted (contested) — the documented failure is Copilot Actions clicking and typing under injection
Attack surface
Computer-use agent
Autonomy level
Semi-autonomous
Initial vector
Cross prompt injection from documents and ui elements
Impact type
Data exfiltration, Malware installation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Windows 11 Insider machines where an administrator enables Experimental agentic features
Capability abused
Defense & remediation
Recorded defense
disabled by default; separate standard 'agent account'; contained agent workspace as a defended security boundary; ACL-limited access to Documents/Downloads/Desktop/Pictures; user approval for sensitive actions; signed-agent requirement
Guardrail kinds
Human approval, Permission scope, Sandbox isolation
Guardrail outcome
Not enabled
Fix shipped
n/a - shipped as an experimental preview with the risk documented
Taxonomy & references
Curator notes
Vendor threat disclosure rather than an observed exploit: retained as the OS-level computer-use-agent baseline because Microsoft documents the concrete threat model for its shipped preview. No public exploit of Copilot Actions on Windows was found during research for this record; that remains an open lead. Microsoft additionally tells users to 'only enable this feature if you understand the security implications'. Doc dated 2025-11-13, support article updated 2025-12-05.
Supporting sources
Cite as
Enkrypt AI. "Microsoft ships Copilot Actions on Windows 11 off-by-default, documenting that cross-prompt injection can cause data exfiltration or malware installation". AIR, AIR-2025-0175. https://agentincident.vercel.app/i/AIR-2025-0175/ (accessed 2026-10-19).