Disclosed vulnerability
Microsoft Copilot Cowork Skills call DeepSeek and Mistral even when the tenant never opted in, and the Skill scanner rates the Skill 100/100
AIR-2026-0124 AIR record · 2026-06-copilot-cowork-deepseek-optout-bypass
From the supporting source
Skills can query DeepSeek in Microsoft Copilot Cowork, even when your organization has NOT opted in to the DeepSeek Preview.promptarmor.com
The record
Disclosed
2026-06
Vendor
Microsoft
Product
Microsoft Copilot Cowork
Risk domain
Privacy › Sensitive data exposure
System type
Generative model
Who acted
Agent acted — the Skills called unapproved external models with tenant data
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Skill calls unapproved external model
Impact type
Data exposure, Governance bypass
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
M365 tenants that believe they have blocked DeepSeek/Mistral via admin settings
Capability abused
Defense & remediation
Recorded defense
M365 Admin Center opt-in control for DeepSeek Preview; Skill scanner
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
incomplete - Microsoft removed the DeepSeek setting but Skills retain access; only remaining control is disabling Copilot Cowork
Taxonomy & references
Curator notes
PROVENANCE CAVEAT: no clear publication date on the page; the cited summary rendered a reference date as '2024', which is inconsistent with Copilot Cowork's existence - 2026-06 in the incident_id is provisional and date_disclosed is left null. PromptArmor. Also notes custom system prompts on these calls bypass Copilot's guardrails, and Microsoft's scanner gave the DeepSeek-calling Skill a perfect 100 'low risk' score. | date_disclosed is recorded to the month only; no source establishes the exact day.
Supporting sources
Cite as
Enkrypt AI. "Microsoft Copilot Cowork Skills call DeepSeek and Mistral even when the tenant never opted in, and the Skill scanner rates the Skill 100/100". AIR, AIR-2026-0124. https://agentincident.vercel.app/i/AIR-2026-0124/ (accessed 2026-10-19).