Microsoft Copilot vulnerability allowed data exfiltration via URL prompts

The exploit allows a malicious URL, when clicked by a user, to trigger Copilot to execute commands without explicit user consent. These commands could instruct Copilot to search the user's email for specific information, such as the latest sender's email address, and exfiltrate it to an attacker-controlled server. In a more severe demonstration, researchers showed that Copilot could be prompted to search for passwords and other sensitive credentials within the inbox and leak them in a similar fashion.

To conceal the data exfiltration, the stolen information was converted to base64 format and appended to a URL that Copilot would automatically open. This process could occur even if the Copilot tab was closed immediately after loading. The researchers outlined a five-step process detailing how a victim clicking a crafted URL could lead to Copilot processing injected prompts with full access to the user's session context and connected applications.

In a separate attack, Varonis demonstrated how prompt injection could be used to poison Copilot's permanent memory. This memory store saves user information and preferences for future sessions. By embedding hidden instructions within a webpage, an attacker could manipulate this memory when a user asks Copilot to summarize the page. Such an attack could enable the forwarding of outputs, filtering of information, biasing responses, or executing attacker-defined actions.