Add and upload your custom skills to OneDrive from within PowerPoint Copilot (Mac)

🚨 The Signal: PowerPoint Copilot users can now create and upload custom skills directly within the application, storing them in personal OneDrive. This increases the risk of data exfiltration and prompt injection via unapproved or malicious custom skills.

The Impact

Users licensed for Copilot are affected, increasing the risk of data exposure and prompt injection through uncontrolled custom AI skills.

• Copilot users: Increased risk of data exfiltration and prompt injection via custom skills.
• Security teams: New attack surface for AI-driven threats and data loss.
• Administrators: Challenges in monitoring and governing custom AI skill usage.
• Organisation: Potential for unapproved data access and compliance breaches.

The Action

1. Review and enforce Microsoft Purview DLP policies for OneDrive to detect and prevent sensitive data exfiltration via custom skills.
2. Implement Microsoft Entra Conditional Access policies to restrict access to Copilot and OneDrive based on device compliance and location.
3. Educate users on the risks of creating and using unverified custom Copilot skills, emphasizing data handling best practices.
4. Monitor Microsoft 365 audit logs for unusual activity related to custom skill creation, upload, and usage in OneDrive.
5. Evaluate and deploy Microsoft Defender for Cloud Apps policies to govern custom skill interactions with sensitive data.

Domain: Agentic-AI · Impact: high · Workload: OneDrive