Copirate 365: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)
7 hours ago
- The talk covers multiple vulnerabilities in M365 and Consumer Copilot, including data exfiltration via HTML preview using CSS background images and font-faces, bypassing CSP restrictions.
- Delayed Tool Invocation (DTI) allows attackers to plant instructions for later execution, enabling persistent compromises.
- M365 Copilot's long-term memory feature, enabled by default without audit logs, can be manipulated via prompt injection to add or delete memories, compromising future conversations.
- The SpAIware attack combines memory persistence with data exfiltration, using prompt injection to create malicious memories that automatically exfiltrate user secrets like passwords via HTML preview.
- Consumer Copilot is also vulnerable to similar attacks, including memory modification via durable facts and data exfiltration through Edge browser navigation.
- Key takeaways include the importance of explicit security contracts for AI widgets, limitations of CSP as a mitigation, need for audit logging, risks of automatic memory writing, and adopting assume-breach threat modeling.