Microsoft’s Copilot Cowork can use your logged-in Edge session to create admin users

cyb3rops · x · 2026-07-29

Microsoft’s Copilot Cowork can use a hidden local Edge tab to complete web tasks with the user’s existing sessions, and a demo post highlights how that can create a powerful foothold inside an enterprise.

• The agent runs in the user’s own Edge copy, so it inherits existing SSO, cookies, and sessions.
• No device access is required, and the poster notes MFA was not enforced on the M365 portal in the demo.
• The example prompt asked the agent to use an existing Azure login to create a user and assign Global Admin.
• The post frames the tradeoff as convenience versus a potentially dangerous access path if those sessions are already live.

Original post →

More from Safety

• VulnCheck finds only 1.3% of AI-assisted bugs were actually exploited — R_D · 2026-07-29
• AI “pacing” systems could become a leveraged control layer, the author warns — TinfoilTricorn · 2026-07-29
• Research Discusses MoE Security Flaw: Safety Layers Might Be AI's Biggest Zero-Day Threat — JimR_Ai_Research · 2026-07-29
• What Anthropic’s alignment-faking paper shows — and what it does not — Passelume · 2026-07-29
• Google’s SynthID is hard to break, but it still won’t fix AI misinformation — davidstutz92 · 2026-07-29
• OpenAI says the Hugging Face exploit came from an internal prototype, not GPT-6 — daniel_mac8 · 2026-07-29

Safety channel →