Microsoft Copilot

Microsoft Copilot Can Surface Overshared Data Despite Permission Boundaries

Microsoft documentation states that Copilot only accesses data authorized for the signed-in user, yet default SharePoint and OneDrive sharing settings often grant broad access that the AI then respects literally. This creates accidental oversharing risks where Copilot retrieves documents shared too widely years earlier. Administrators can use Content Management Assessment and Data access governance reports, including the EEEU report covering the top 100 sites shared in the past 28 days, to identify problematic content. Two distinct controls exist: Restricted Access Control removes access entirely while Restricted Content Discovery hides items from Copilot and search without altering permissions. Sensitivity labels combined with encryption can exclude programmatic access for agents, though Microsoft does not guarantee outright blocking. Interaction logs stored in Microsoft Purview retain user prompts, Copilot responses, and citations to accessed documents, providing an audit trail for oversharing incidents.

Microsoft Copilot Abused to Accelerate Corporate Account Takeovers and Bank Transfer Frauds

Cybercriminals can leverage Microsoft Copilot to speed up the compromise of corporate accounts and execute financial frauds. In a controlled simulation, researchers demonstrated how the AI assistant helped redirect a $247,500 bank transfer after gaining access to an employee's email. The attack begins with the creation of inbox rules that automatically delete suspicious login alerts, followed by rapid analysis of internal communications to identify high-value targets. Copilot was then used to replicate the victim's writing style and craft a convincing phishing email capable of stealing session tokens and bypassing multi-factor authentication. Once the executive account was taken over, the tool quickly located pending payments and generated a fraudulent request to alter the recipient bank details. The scenario highlights risks from legitimate AI features rather than any specific vulnerability in Copilot itself.