Zenity Microsoft 365 Copilot RCE via Email/Teams/Calendar
Date: 2024-08
Affected: Microsoft 365 Copilot
Attack vector: rce
Category: research
Severity: Critical

Zenity demonstrated full ~RCE in M365 Copilot via remote injection through email, Teams message or calendar invite, paired with a jailbreak for code execution.


Mitigations:

Architectural layers (MAESTRO):