Copirate 365 DEF CON: Plundering Microsoft Copilot (CVE-2026-24299)
Date: 2026-08
Affected: Microsoft 365 Copilot
Attack vector: data-exfiltration
Category: research
Severity: Critical

Rehberger and co-researchers presented Copirate 365 at DEF CON disclosing CVE-2026-24299 in Microsoft Copilot - chained prompt injection and tool abuse for deeper M365 data plundering.


Mitigations:

Architectural layers (MAESTRO):