Critics scoff after Microsoft warns AI feature can infect machines and pilfer data

Microsoft warned on 19 November 2025 that an experimental AI Agent called Copilot Actions, integrated into Windows, can infect devices and pilfer sensitive user data, a claim that security critics quickly debated. The feature is off by default and described as an “experimental agentic feature” that can perform tasks such as organising files, scheduling meetings, or sending emails when enabled.

Microsoft acknowledged flaws common to large language models, including hallucinations and prompt injections, and warned that agentic AI applications introduce new security risks such as cross-prompt injection (XPIA) that can lead to data exfiltration or malware installation. The company emphasised that Copilot Actions is currently available only in beta and advised that only experienced users enable it, with admins able to manage access at account and device levels via Intune or other MDM apps.

Some security researchers questioned the warnings, comparing them to macro cautions that have long been issued for Office apps, while others stressed the difficulty of preventing exploitation even for seasoned users. According to Ars Technica, critics argued that such warnings may amount to shifting liability to users, and noted that previous experimental features often become standard over time.