Microsoft Patches a Critical Copilot Cowork Privilege Escalation and a Copilot Command-Injection Flaw (CVE-2026-59118, CVE-2026-70335)

Microsoft Copilot Cowork within the Microsoft 365 Copilot ecosystem, and GitHub Copilot in Visual Studio Code

The August 2026 Patch Tuesday closed 421 vulnerabilities, 62 of them critical, and included three AI-specific fixes. CVE-2026-59118 (CVSS 9.3) is an improper authorization flaw in Copilot Cowork that lets an unauthorized attacker elevate privileges over the network with low attack complexity and a changed scope; because Cowork operates with access to organizational content, the flaw reaches data across connected Microsoft 365 services. CVE-2026-70335 (CVSS 7.8) is OS command injection in GitHub Copilot and Visual Studio Code: an attacker embeds instructions in content the agent processes, such as a web page, a repository file, or a tool response, and when the user runs the agent against that content the injected instructions cause commands to run on the machine without a confirmation prompt, executing as the signed-in user. Two further Visual Studio Code security-feature bypasses, CVE-2026-58650 and CVE-2026-69278, were rated important with "exploitation more likely." The single zero-day exploited in the wild that month, CVE-2026-68820, was unrelated to AI

In Cowork, an authorization check that did not match the breadth of access the agent holds. In Copilot for VS Code, prompt injection reaching a shell with the confirmation step skipped, which is the same harness-level failure pattern disclosed at Black Hat six days earlier: the model layer is asked to distinguish content from instruction, and the execution layer honors whatever the model produced