Microsoft Excel Zero-Day Enables Zero-Click Data Exfiltration via Copilot Agent Mode

Microsoft's March Patch Tuesday revealed CVE-2026-26144, an Excel information disclosure flaw that enables zero-click data exfiltration through Copilot Agent mode. An attacker can cause Copilot to exfiltrate data via unintended network egress without user interaction. The vulnerability highlights a novel attack surface where AI assistants become the exploitation vector rather than the target. The March update addressed 79 total flaws including two publicly disclosed zero-days.