Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) · Embrace The Red

This is a writeup of my DEF CON Singapore talk that walks through vulnerabilities and exploits in M365 Copilot and Consumer Copilot. I disclosed these to Microsoft last year. MSRC assigned CVE-2026-24299 and the issues are now patched.

Contents

This turned out to be a long post, covering the 45 minute talk. I added an index page, so you know what’s in here. The talk had a more demos by the way, but I included videos here in this post also.

Preface: A Brief History of AI Data Exfiltration

The Lethal Trifecta and M365 Copilot

Extracting System Prompt Information and Tools

Chapter 1: HTML Preview as Exfiltration Channel

Bypass 1: Background Images via CSS

Bypass 2: Loading Fonts via @font-face

Auto-Switching to HTML Preview

Walkthrough: Stealing Emails from Word

Take-away: AI Widgets and Host Contracts

Chapter 2: Delayed Tool Invocation

Chapter 3: M365 Copilot Got Memory!

Adding Memories via Prompt Injection

Deleting Memories via Prompt Injection

Chapter 4: SpAIware (Persistence + Data Exfil)

Encore: Hacking Consumer Copilot

Hacking Consumer Copilot Memory (Durable Facts)

Exfiltrating Data with Edge

Epilogue: Take-aways

Disclosure Timeline

A pdf version of the slides is on the DEF CON media server.

Let’s dive into it.

Introduction

The presentation walks through a chain of vulnerabilities across the Microsoft Copilot family, incl. data exfiltration via the HTML preview feature, Delayed Tool Invocation as an exploit reliability trick, hijacking long-term memory, and combining all of the above into a persistent backdoor.

To kick off the talk, I started with the following question.

How Many Copilots Are There?

Did you know that there are now over 80 products called “Copilot” : chatbots, desktop apps, web apps, mobile apps,..

There is even a Copilot keyboard key!

Throughout this post “Copilot” mostly means M365 Copilot , the enterprise BizChat experience and the various variations in the Office suite, with a detour at the end into the consumer copilot.microsoft.com .

Preface: A long, long time ago…

The history of LLM-powered data exfiltration via image rendering goes back to my Bing Chat data exfil writeup and Roman Samoilenko’s post as well. That was 3 years ago. Time flies.

After I reported the vulnerability to Microsoft back in 2023, they were the first vendor to acknowledge and address the vulnerability. Soon after, Claude, Bard/Gemini, GitHub Copilot, ChatGPT, and many others followed up with fixes and improvements. The list of vendors that had this issue and needed to patch their AI is now large. It’s one of the most common AI application security vulnerabilities.

The Lethal Trifecta

Somewhere along the way Simon Willison coined this excellent term, and it depicts that when an AI assistant has access to private data , untrusted content , and a way to externally communicate , you have the lethal trifecta. It allows for prompt injection to leak sensitive user data.

The Lethal Trifecta and M365 Copilot

The various M365 Copilots have access to read your emails, chat conversations, SharePoint docs, and so on, and it ingests that content (which includes of course untrusted data, like emails, shared docs) into the context window. So, it already has two of the pillars of the lethal trifecta by default.

The external communication channel is the only part of this system that is realistically enforceable, which is why most mitigations focus there. Indirect prompt injection is a behavior that pushes the model into misalignment. It does not have a deterministic fix, and as we have been saying for the last 3 years the correct mitigation is to limit or specifically allow what actions and impact an AI agent can have (threat model the worst case scenario): Trust No AI.

Extracting System Prompt Information and Tools

Over time I noticed that Microsoft put more and more effort into preventing system prompt extraction. In my talk I showed a simple way I bypassed this in the past by just having Copilot print the system prompt in German, rather than English.

When I retested this a few weeks ago while preparing for the presentation, it was now blocked as well. It also refused to answer a simple question, like list all your tools.

However, since I was interested if there are any new tools I did a quick bypass by asking Copilot to create an xml document and print the names of the tools as XML elements into the document. That worked:

What was interesting is that there are a few tools that now have a different name, since I looked at it last. For instance, the enterprise_search_* tools are now called office365_*.

There is also the record_memory tool and a canmore_create_textdoc, which is similar to the ChatGPT artifact tools with the same name. The canmore tool then made me wonder if we can render HTML with it, and to my surprise...