Microsoft Patches Critical Privilege Bug in New Copilot Cowork Agent

Microsoft’s August Patch Tuesday round included the usual pile of Windows and Office fixes, but one entry stood out for anyone tracking agentic AI risk: a critical elevation of privilege bug in Copilot Cowork, the company’s newest and most autonomous Copilot product. The flaw is tracked as CVE-2026-59118 and it scores 9.3 out of 10 on CVSS 3.1. That’s about as bad as these ratings get without full remote code execution attached.

What actually broke

The root cause is improper authorization, CWE-285 in the standard weakness taxonomy. In plain terms, Cowork wasn’t checking permissions the way it should have been when handling certain requests. According to the CVSS vector Microsoft published (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), an attacker needs no prior privileges and the attack complexity is low, though it does require some user interaction and the scope is changed, meaning a successful exploit can reach beyond the component where the bug lives. Confidentiality and integrity impact are both rated high. Availability isn’t affected, so this isn’t a denial-of-service story. It’s an access story.

Here’s the part that makes it worth a second look rather than just filing it under routine patch news: Cowork isn’t a chatbot with a text box. It’s an agent designed to take multi-step action across a person’s Microsoft 365 footprint on its own initiative, drafting documents, scheduling meetings, sending emails, posting to Teams, pulling context from what Microsoft calls Work IQ. Cowork only went generally available in mid-June. Two months later it already has a critical privilege escalation bug in production. If you’ve watched how fast enterprises have been rolling these agents into real workflows, that timeline probably doesn’t surprise you much.

Why authorization bugs in agents matter more

A privilege escalation flaw in a normal SaaS app is bad enough. In an agent that’s explicitly built to act across connected apps and files without a human clicking through every step, an authorization gap changes what “elevated privilege” actually buys an attacker. It’s not just reading a file you shouldn’t. It’s potentially getting the agent itself to carry out actions under a broader permission set than it was supposed to have, using the same execution pathway the product markets as its main feature.

Microsoft hasn’t published exploit details, and there’s no indication yet that CVE-2026-59118 was used against anyone before the patch landed. That’s the good outcome here: a vulnerability found and fixed through normal disclosure channels rather than discovered because something already broke. Still, the pattern is becoming familiar. Ship an agentic product, watch it get adopted fast because it saves people real time, then find out the authorization model underneath wasn’t as tight as the marketing implied.

The bigger picture

This is the second Microsoft agent to draw scrutiny in as many months. Azure SRE Agent had its own critical privilege escalation issue disclosed earlier in August, and separate research into Copilot’s consumer product has turned up data exposure problems through entirely different mechanisms. None of these are the same bug wearing a different CVE number. They’re independent findings against related products built on a shared premise: give an AI system broad reach across your data and workflows, and trust the authorization layer to hold the line. When that layer has gaps, the blast radius follows the agent’s reach, not the size of the original bug.

For security teams, the practical takeaway isn’t dramatic. Confirm your tenant has the August patch, which for a cloud service like Cowork should already be automatic. What’s worth actual time is reviewing what permissions your Cowork agents currently hold and whether that scope matches what the business tasks running through them actually need. Agent permissioning is still young as a discipline, and bugs like this one are a reminder that “it’s just an AI assistant” stopped being an accurate description of what these tools can touch a while ago.

References

• CrowdStrike — August 2026 Patch Tuesday: Updates and Analysis
• Qualys — Microsoft and Adobe Patch Tuesday, August 2026 Security Update Review
• Tenable — CVE-2026-59118
• Microsoft Security Response Center — CVE-2026-59118 Copilot Cowork Elevation of Privilege Vulnerability
• Microsoft 365 Blog — Copilot Cowork is now generally available