Copilot agent turns patched Excel bug into zero-click leak

// 45d agoSECURITY INCIDENT

Copilot agent turns patched Excel bug into zero-click leak

Researchers demonstrated that a previously patched XSS vulnerability in Excel can be exploited via Microsoft Copilot to silently exfiltrate data. The exploit highlights how autonomous agents can bypass traditional security to resurrect old vulnerabilities.

// ANALYSIS

Autonomous agents are creating new, unexpected attack surfaces that bypass traditional security monitoring.

–Attackers used the Copilot agent to exploit a patched XSS bug in Excel
–Data can be silently read and exfiltrated without user interaction
–Highlights the risk of agents amplifying the impact of older vulnerabilities
–Traditional security tools struggle to monitor agent-driven data access

// TAGS

microsoft-copilotagentsafety

DISCOVERED

45d ago

2026-04-24

PUBLISHED

45d ago

2026-04-24

RELEVANCE

9/ 10

AUTHOR

Better Stack

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

NEWS24m ago

Siri gains agentic capabilities at Apple WWDC

A commentary on Apple's WWDC keynote highlights Siri's new contextual awareness and agentic capabilities. While deep context access provides unprecedented situational awareness, Siri's agentic actions operate within predefined boundaries.

OPEN SOURCE46m ago

Roboflow Supervision simplifies computer vision development with its comprehensive suite of reusable, model-agnostic tools.

Roboflow's Supervision is an open-source Python library designed to streamline the implementation of computer vision workflows. By providing modular components for loading datasets, running detections, visualizing bounding boxes, and monitoring interactive zones, it eliminates repetitive boilerplate code. Supervision works seamlessly across popular models and frameworks like YOLO, Hugging Face Transformers, SAM, and Detectron2, serving as a cohesive bridge between model outputs and final applications.

UPDATE56m ago

Quartr launches native MCP connector for Perplexity Computer

Quartr has officially launched as a native Model Context Protocol (MCP) connector for Perplexity Computer. This integration allows users to directly access 43 distinct financial and investor relations tools from Quartr within the Perplexity environment, expanding the platform's capabilities for financial research and analysis.