Copilot · Microsoft · Ars Technica
Critical Copilot flaw allowed hackers to seal 2FA code from users
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Last Tuesday, Microsoft patched a vulnerability it rated as max critical in its M365 Copilot AI platform.
Key facts
- The Parameter-to-Prompt Injection is a close relative of the prompt injection
- Last Tuesday, Microsoft patched a vulnerability it rated as max critical in its M365 Copilot AI platform
- To bring about the Parameter-to-Prompt Injection an attacker sends the target an email that contains the URL with the syntax The field contains an instruction
- Before that, Copilot generated its response using raw HTML, which is temporarily rendered in the browser DOM
Summary
Microsoft and other LLM providers have been unable to prevent their products from complying with malicious requests to reveal data. One guardrail built into Copilot and most other LLMs prevents them from submitting web forms, sending emails, and taking similar actions that can be used to exfiltrate data from the user. One Microsoft guardrail wraps Copilot output in <code> blocks so the browser treats it as straight text. Security firm Varonis devised an exploit chain that could catapult over these guardrails. The parameter in this case is the q in a URL, which is used to flag a query that has been included.