Copilot Cowork Acts Alone, the SOC Doesn’t See It

By Alec Chizhik · May 15, 2026 · 10 min read

7 Min. Read Time

Microsoft has introduced Copilot Cowork in Wave 3, a mode that acts independently: sending emails, scheduling appointments, modifying documents, over multiple steps and in the background. This is no longer a chatbot, but an agent with the rights of its user. For security teams, the question shifts. It’s no longer about what the user types, but what the agent triggers in their name. And whether the SOC even sees it.

Key Takeaways

Cowork acts, no longer just responds. The Wave 3 mode executes multi-step tasks autonomously in the background and takes real actions, with the permissions of the respective user.
Prompt injection becomes an action chain. A manipulated email or a prepared document that the agent reads in the middle of the task can redirect the following steps.
The stop gate is optional. Cowork can be checked, steered, and stopped. Without a set release threshold, the human sees the consequential action only afterwards.
The audit trail is not automatic. Cowork events are loggable, but the Purview logging must be configured specifically for this. Without this step, the SOC has no telemetry.

What is Copilot Cowork? Cowork is the central new mode from Microsoft’s Copilot Wave 3, presented on March 9, 2026, and built in collaboration with Anthropic. Unlike the dialog-based Copilot, Cowork executes long-running, multi-step tasks and takes real actions: scheduling appointments, sending emails, editing documents. The task runs in the background while the user works on something else. Cowork starts as a Research Preview with selected customers and runs through the Frontier program.

From Assistant to Actor

The security-relevant break lies not in the AI itself, but in the transition from suggestion to action. A dialog-based Copilot formulates an email draft that a human reads, checks, and sends. Cowork sends the email itself, because sending is part of the assigned task. There is no longer a human click between intention and effect.

Microsoft describes Cowork consciously with control vocabulary. The work is observable, the actions transparent, the progress can be checked, steered, and stopped. Everything runs within the security, identity, and governance framework of Microsoft 365. That’s true. But it’s only half the statement. Observable doesn’t mean observed. Stoppable doesn’t mean stopped. The capabilities exist, their effectiveness depends on configuration and process.

For a security team, this is the decisive distinction. Cowork acts with the identity and permissions of the user who started the task. An agent running for a sales leader can access their mailbox, documents, and contacts. If this agent is steered in the wrong direction, it doesn’t act as an anonymous script, but as this sales leader.

Prompt Injection Evolves into an Action Chain

Prompt injection is a known attack pattern. What’s new is the leverage gained when the target isn’t a chat window, but an ongoing action chain. Consider this example from an incident perspective: A coworker is tasked with reviewing incoming supplier emails and responding to queries. In one of these emails, an invisible instruction is embedded in the body or in white text, instructing the agent to set up a forwarding rule or send a specific file to an external address.

The agent differentiates between data and instructions less effectively than a human. If it reads the manipulated email during a multi-step task, the injected command can alter the subsequent steps. The user initiated a harmless task, but the agent ultimately performs an additional, unauthorized action. Since both occur within the same session and under the same identity, the log appears to show a coherent, intentional action.

This marks a departure from classical injection. Previously, the attack ended with an incorrect response in the chat. Now, it concludes with an executed action having real consequences, embedded within a chain of legitimate steps. The chain serves as camouflage.

Where the Human-in-the-Loop Gate is Missing

Microsoft has established control points. Cowork can be monitored, directed, and paused. The open question is at what point human intervention is mandatory before a consequential action is executed. This is where configuration determines the risk.

Without a defined approval threshold, the default logic applies: The agent proceeds, and humans can observe. Those who don’t observe see the result. For tasks like summarizing internal notes, this is acceptable. However, for tasks that involve sending an email externally or modifying a shared document in one step, it is not. Such actions require a gate that enforces human confirmation.

Security teams should not universally permit or prohibit Cowork tasks. Instead, they should classify tasks based on their impact. Actions without external effects can proceed. Actions with external effects or write access to shared content necessitate a confirmation step. This classification requires manual effort but represents the most effective single lever a company can pull before rollout.

The Detection Gap in SOC

The most critical point is the most inconspicuous one. Microsoft notes that every Cowork action is auditable. However, there’s a condition: organizations must configure Purview audit logging specifically for Cowork events to maintain compliance. Auditable and audited are two different states.

What Remains Open

Cowork events without configured Purview logging do not generate SOC telemetry
Agent actions run under user identity and do not show up in standard logs
No gate before consequential actions if no approval threshold is set
Prompt injection in action chains leaves a seemingly legitimate sequence of steps

What to Do Before Rollout

Explicitly enable Purview audit logging for Cowork events
Classify Cowork tasks by external impact and set gates
Supplement detection rules for anomalous agent actions in SOC
Limit Cowork permissions to a pilot group, do not release widely

A company that enables Cowork without turning on logging has an autonomous actor on the network whose actions do not appear in the standard audit trail. In the event of an incident, exactly the trail that shows what the agent did and when is missing. Forensics then starts not with logs but with a gap.

Additionally, there’s an identity problem. Since Cowork operates under the identity of the commissioning user, its actions do not trigger obvious anomalies in SIEM and EDR. An email sent by a user account is initially normal. That an agent was behind it, redirected by a manipulated input, is not indicated in any standard alert. Detection of agent activity is a separate task, not a byproduct of existing rules.

What Security Teams Should Do Now

Cowork is currently in its early stages through the Frontier program and as a Research Preview. This is the right time window to set controls before the broad rollout. Four steps should be taken upfront.

First, logging. Enable Purview audit logging for Cowork events before the first productive agent goes live. Without this step, every further measure is blind.

Second, classification. Sort Cowork tasks by external impact. Actions that send externally or modify shared content require forced human confirmation. Actions without external impact can proceed.

Third, detection. SOC needs rules for anomalous agent behavior: unusual forwarding rules, mass file accesses in a short time, external communication outside the usual pattern. These rules do not emerge on their own.

Fourth, pilot group. Cowork starts with a limited user group, not the entire workforce. The pilot provides the real action patterns against which detection rules can be calibrated.

The assessment is sober. Cowork is not an uncontrollable risk. Microsoft has provided the tools for control. The mistake would be to keep the control tools for oneself. An agent that acts autonomously is only as secure as the gates and logs a security team has set before rollout. After that, it’s cleanup work.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

What is Copilot Cowork?

Cowork is the new autonomous mode from Microsoft’s Copilot Wave 3, introduced on March 9, 2026. It executes long-running, multi-step tasks in the background and performs actual actions, such as scheduling appointments, sending emails, and editing documents. Cowork was developed in collaboration with Anthropic and is launching as a Research Preview through the Frontier program.

Why is Cowork a Security Topic?

Cowork not only suggests text but also executes actions – with the identity and permissions of the assigning user. There is no human click between intention and effect. If the agent is redirected through a manipulated input, it acts as this user without being noticed in the standard protocol.

How does Prompt Injection work with an Autonomous Agent?

The agent reads content such as emails or documents during a task. If such content contains a hidden instruction, the agent can treat it as a command instead of data. In a multi-step task, this redirects the following steps. The result is an executed, unauthorized action embedded in an otherwise legitimate sequence of steps.

Are Cowork Actions Traceable?

They are auditable but not automatically logged. Organizations must configure Purview audit logging specifically for Cowork events. Without this step, the actions do not generate SOC telemetry. In the event of an incident, the trail of what the agent did and when is missing.

What Should Security Teams Do Before Rollout?

Four things: enable Purview audit logging for Cowork, classify Cowork tasks according to their external impact and set approval gates, supplement detection rules for anomalous agent actions in the SOC, and initially limit Cowork to a pilot group instead of releasing it widely.

Editor’s Reading Recommendations

Editor’s Picks

Editor’s PickNIS2 Audit: How the Vendor List Crumbles in Two Hours Editor’s PickAdaptive MFA: NIS2 Pressure as a Zero-Trust Editor’s PickDetection Engineering Without Vendor Lock: Wazuh Stack 2026

More from the MBF Media Network

cloudmagazinCopilot Studio Becomes the Agent Control Center MyBusinessFutureMicrosoft’s AI bundle for $99: Is the jump worth it?Digital ChiefsAgent 365 orders the AI agents, liability remains open