File-Extension-Restriction-Bypass-in-Microsoft-365-Copilot
PublicMicrosoft 365 Copilot enforces file extension restrictions only at the time of upload. Once a file is uploaded, it can be modified to a disallowed type (e.g., .exe, .vps) while retaining its original UniqueId. Copilot continues to access and process the file without rechecking its extension or type.