Windows 11 Agents Get Read and Write Access to Six Personal Folders

Windows 11 Build 26220.7262 contains a working Agent Workspace that lets AI agents read and write to six personal folders in the background, a capability that raises real security questions even with consent gates in place. The permission model Microsoft has built is more granular than early reports suggested, but the attack surface is genuinely new.

How Agent Permissions Work

Agents running inside the workspace, Microsoft Copilot and potentially third-party tools, get their own runtime environment, a dedicated desktop and a separate user account. That isolation lets them operate in the background without interfering with an active session. The six folders they can touch (Desktop, Documents, Downloads, Music, Pictures, and Videos) are drawn from Windows’ Known Folders system, so the paths resolve correctly even if a user has redirected them.

Access isn’t granted by default. Users configure it under Settings > System > AI Components > Agents, choosing Allow Always, Ask Every Time or Never Allow on a per-agent basis. The permission applies collectively to all six folders, there’s no per-folder granularity. When an agent makes its first file access attempt, a consent prompt appears before anything happens. Approving Copilot does not extend any permission to a third-party agent installed later.

The Prompt Injection Risk

Broad file access creates a concrete attack vector: cross-prompt injection. Malicious instructions embedded in a document or webpage can redirect an agent mid-task, potentially triggering unauthorised operations, malware installation, data exfiltration, without the user initiating anything. The Agent Workspace addresses this through policy enforcement, activity logging and session isolation, but the threat is architectural rather than something a permission dialog fully neutralises. Users can review agent activity logs after the fact, though that’s a detection mechanism, not a prevention one.

Enterprise deployments get additional controls. Microsoft’s enterprise data protection commitment applies to Microsoft 365 Copilot users signed in with a Microsoft Entra work or school account, layering compliance and privacy controls on top of the base Windows permission model. IT departments can also push group policies to restrict or block Copilot installation entirely, which matters for organisations running sensitive workloads.

The Hardware Requirement

Running agents locally requires significantly more than a standard Windows 11 machine. Copilot+ PCs, Microsoft’s designation for hardware built around the Agent Workspace and related AI features in Windows 11 version 24H2, need an NPU capable of at least 40 TOPS and 16GB of DDR5 or LPDDR5 RAM, well above the base Windows 11 spec of a 1 GHz dual-core CPU, 4GB RAM and 64GB storage.

The on-device Copilot footprint is also much lighter than its web-based predecessor, with recent reports suggesting a significantly smaller RAM usage when running in the background or at idle.

Privacy Controls for End Users

File access permissions are one layer of a broader set of privacy controls Microsoft has built into the Copilot experience. Users can also adjust personalisation settings, opt out of having conversation data used for model training and disable personalised ads, all accessible through the Copilot app settings or the Microsoft account privacy dashboard. Conversation history defaults to an 18-month retention window but can be deleted individually or cleared entirely at any time.

The consent framework is more considered than the initial coverage implied. Whether it holds up as third-party agents proliferate inside the workspace is the harder question, and one Microsoft hasn’t fully answered yet.