Research demo
Microsoft's Copilot Cowork Skill security scanner misses 89% of malicious Skills, and 99.6% after one obfuscation step
AIR-2026-0177 AIR record · 2026-08-microsoft-skill-scanner-bypass-1m-skills
From the supporting source
We seeded 1,046,565 unique Skills across six marketplaces with malicious content from Microsoft's own BIPIA benchmark and ran Microsoft's Skill security scan.promptarmor.com
The record
Disclosed
2026-08
Vendor
Microsoft
Product
Microsoft Copilot Cowork built-in Skill security scan
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Policy drift
System type
Generative model
Who acted
AI was the target (contested) — the defender's LLM-based Skill scanner is the thing being defeated
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Malicious skill
Impact type
Defense evasion
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
every org relying on Microsoft's Skill scan to vet Copilot Cowork Skills
Capability abused
Defense & remediation
Recorded defense
Microsoft's built-in Skill security scanner
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none stated
Taxonomy & references
Curator notes
PROVENANCE CAVEAT: the page carries no publication date; 2026-08 in the incident_id is provisional and date_disclosed is left null. PromptArmor. Detection rate ~11% baseline, 0.4% after splitting flagged keywords. Compare 2026-05-gecko-skill-scanner-test-file-bypass and 2026-07-skillcloak-scanner-evasion for the same defense-evasion theme against other scanners. | date_disclosed is recorded to the month only; no source establishes the exact day.
Supporting sources
Cite as
Enkrypt AI. "Microsoft's Copilot Cowork Skill security scanner misses 89% of malicious Skills, and 99.6% after one obfuscation step". AIR, AIR-2026-0177. https://agentincident.vercel.app/i/AIR-2026-0177/ (accessed 2026-10-19).