-
·
The Bug Is the Doorway. The Agent Is the Burglar.
On March 10, 2026, Microsoft patched CVE-2026-26144. It’s an XSS bug in Excel. CVSS 7.5. On paper, medium-severity, the kind of thing that used to mean a stolen session cookie and a compliance ticket. This one doesn’t steal cookies. A malicious payload embedded in a spreadsheet fires when Excel renders it, hijacks Copilot Agent, and…