Disclosed vulnerability
Microsoft 365 Copilot: prompt injection to automatic tool invocation and ASCII-smuggled data exfiltration
AIR-2024-0038 AIR record · 2024-08-microsoft-copilot-ascii-smuggling-exfil
From the supporting source
This vulnerability warrants a deep dive, because it combines a variety of novel attack techniques that are not even two years old.embracethered.com
The record
Disclosed
2024-08-26
Vendor
Microsoft
Product
Microsoft 365 Copilot
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot auto-invoked tools and rendered the smuggled exfiltration link
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection email
Impact type
Data exfiltration, Pii disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
M365 Copilot tenants
Capability abused
Defense & remediation
Recorded defense
Copilot content handling and hyperlink rendering
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
fixed by Microsoft around May 2024; mitigation details not publicly disclosed
Taxonomy & references
Curator notes
Johann Rehberger. Demonstrated exfiltration of emails, MFA codes and sales data. Microsoft reviewed the draft before publication.
Supporting sources
Cite as
Enkrypt AI. "Microsoft 365 Copilot: prompt injection to automatic tool invocation and ASCII-smuggled data exfiltration". AIR, AIR-2024-0038. https://agentincident.vercel.app/i/AIR-2024-0038/ (accessed 2026-10-19).