Upload or add a custom skill with Copilot in PowerPoint (Web)

🚨 The Signal: PowerPoint Copilot users can now create and upload custom skills, stored in OneDrive. This expands Copilot's capabilities but introduces new vectors for data exfiltration and prompt injection, requiring careful governance and data loss prevention.

The Impact

Users with Copilot licenses are affected, facing increased risk of data exposure and prompt injection through custom AI skills.

  • Copilot users: Risk of inadvertent data exposure via custom skills.
  • Copilot users: Increased susceptibility to prompt injection attacks.
  • Security teams: New vectors for data exfiltration and compliance breaches.
  • Administrators: Need to govern custom AI skill creation and usage.

The Action

  1. Review and update existing Data Loss Prevention (DLP) policies to include custom Copilot skill files (e.g., .json, .yaml) stored in OneDrive.
  2. Implement or refine Microsoft Purview policies to monitor and restrict sharing of custom Copilot skills containing sensitive information.
  3. Educate users on the risks of creating and using custom Copilot skills, emphasizing data privacy and prompt injection awareness.
  4. Evaluate Microsoft 365 Copilot governance settings for any future controls related to custom skill management or restriction.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps