Last Tuesday, Microsoft implemented a critical patch for a vulnerability in its M365 Copilot AI platform. This issue was identified by researchers who disclosed that their proof-of-concept exploit could access two-factor authentication codes and other sensitive information from emails utilized by the Copilot feature.
The exploit stems from a fundamental flaw in how AI systems interpret user instructions versus third-party content. This vulnerability has left Microsoft and its peers struggling to build effective safeguards against unauthorized data extraction. Hackers have devised methods to bypass existing guardrails by using markup languages, which allow for the embedding of sensitive data in ways that can evade detection.
Among the guardrails established by Microsoft, one restricts Copilot from submitting forms or sending emails that might lead to data breaches. However, researchers from Varonis discovered a technique known as Parameter-to-Prompt Injection, which manipulates URL parameters to execute malicious commands, posing a significant threat to data security.