Microsoft’s Copilot Cowork can use your logged-in Edge session to create admin users
cyb3rops · x · 2026-07-29
Microsoft’s Copilot Cowork can use a hidden local Edge tab to complete web tasks with the user’s existing sessions, and a demo post highlights how that can create a powerful foothold inside an enterprise.
- The agent runs in the user’s own Edge copy, so it inherits existing SSO, cookies, and sessions.
- No device access is required, and the poster notes MFA was not enforced on the M365 portal in the demo.
- The example prompt asked the agent to use an existing Azure login to create a user and assign Global Admin.
- The post frames the tradeoff as convenience versus a potentially dangerous access path if those sessions are already live.
More from Safety
- China drafts export controls on 23 AI technologies; already open-sourced tech exempted — Stannis_Loyalist · 2026-10-16
- Anthropic grants METR inside access to audit its AI models and safety practices — The Decoder · 2026-10-16
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16
- Vitalik builds "paranoid mode" agent wrapper with Tor, zkAPI and local prompt rewriting — DavideCrapis · 2026-10-16
- Security team demos Signal 1-click exploit technique at Hexacon Paris — moyix · 2026-10-16
- China moves to impose registration and licensing on frontier AI model weights and chip designs — deanwball · 2026-10-16