Microsoft Copilot for M365 — document exfiltration via indirect injection
Date: 2024-08
Affected: Microsoft Copilot for Microsoft 365 — organisations using Copilot with SharePoint/OneDrive access
Attack vector: indirect-prompt-injection
Category: research-demonstrated
Severity: Critical

Researcher Michael Bargury (Zenity Labs) demonstrated at DEF CON 32 that Microsoft Copilot for Microsoft 365 was vulnerable to a chain of indirect prompt injection attacks that could exfiltrate documents from the victim's SharePoint and OneDrive. By sending a victim a crafted email or document containing hidden instructions, an attacker could cause Copilot to search for sensitive documents (e.g., salary information, passwords), extract their contents, and exfiltrate them to an attacker-controlled server via ASCII-smuggling in generated URLs. The attack was demonstrated live on stage and worked end-to-end without user awareness.

Impact: End-to-end document exfiltration demonstrated; sensitive files (salary data, passwords, strategic documents) retrievable without user awareness

Mitigations:
Require explicit user confirmation before any read action across document repositories
Content trust boundary — treat document content as untrusted, separate from system instructions
Limit Copilot's data access scope to documents relevant to the current task
Monitor and alert on bulk document access patterns via AI agent
URL and output inspection to detect ASCII-smuggling exfiltration channels

Architectural layers (MAESTRO):
label: Data Operations
notes: Attacker-controlled document content injected into Copilot context — no content sanitisation at retrieval
role: origin
label: Agent Frameworks
notes: Copilot's tool access to SharePoint/OneDrive used without authorisation check per action
role: propagation
label: Security & Compliance
notes: Identity and access controls at SharePoint layer not sufficient to prevent agent-mediated exfiltration
role: blind-spot
label: Agent Ecosystem
notes: ASCII-smuggling in inter-agent URL generation enabled covert exfiltration channel
role: impact