What happened
Johann Rehberger is a security researcher who writes as Embrace The Red. On 17 January 2024 he reported a prompt injection problem in Microsoft 365 Copilot to the Microsoft Security Response Center. It was closed as low severity the next day. On 10 February he reported a full exploit chain. By 2 July his demonstration no longer worked. He presented it at the HITCON conference on 24 August and published the details on 26 August 2024.
Microsoft did not say how it fixed the problem and no CVE was named. A Microsoft spokesperson told The Register that the company had made several changes to help protect customers.
The email
The attack started with content the user received: an email, or a document shared with them. The Register described a phishing email carrying a Word document. Inside were instructions aimed at Copilot, not at the person.
When the user asked Copilot about the message, the instructions took over. They made Copilot run its own search tool, without being asked, to pull other emails and documents into the conversation. In the demonstration these held sales figures and multi-factor codes from Slack. The instructions then had Copilot write that data into a link, using Unicode Tag characters. These characters are invisible on screen, so the link looked harmless. The technique is called ASCII smuggling. A click on the link sent the hidden data to the researcher's server.
Why it worked
An assistant that reads mail and can search a mailbox has two powers an attacker wants. It reads untrusted text, and it can act on what it reads. Rehberger's point was that the model cannot reliably tell the user's request from instructions inside the content. He wrote that prompt injection has no fix at present, so Copilot being vulnerable was no surprise.
The invisible characters closed the loop. The user saw a normal link in Copilot's answer. Nothing on screen showed that it carried their data.
What it cost
Nothing that is known. This was research reported to Microsoft, and the exploit stopped working before it was published. The value of the case is the method. It showed in early 2024 that an email could direct an assistant to search a mailbox and hide what it found, a pattern later cases in this archive repeat.
What would have helped
Microsoft's changes stopped the exploit and, Rehberger reported, stopped such links from rendering. The general lessons hold for any assistant: limit what it can search on its own, do not render links or images an outside message asks for, and show users what the assistant did on their behalf.
What a warning inside the message would have shown. Antilure checks each message for hidden instructions aimed at AI assistants, and for look-alike and invisible characters. When it finds them, its banner tells the reader not to let an assistant act on that message.
Sources
- Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information, Johann Rehberger, Embrace The Red, 26 August 2024.
- The Register's report on the findings, with a statement from Microsoft, The Register, 28 August 2024.