AIR-2026-0100 · Copirate 365 at DEF CON: data exfiltration, memory hijacking and a persistent backdoor in Microsoft Copilot (CVE-2026-24299)

Copirate 365 at DEF CON: data exfiltration, memory hijacking and a persistent backdoor in Microsoft Copilot (CVE-2026-24299)

AIR-2026-0100 AIR record · 2026-05-microsoft-copirate-365

From the supporting source

data exfiltration via the HTML preview feature, Delayed Tool Invocation as an exploit reliability trick, hijacking long-term memory, and combining all of the above into a persistent backdoorembracethered.com

The record

Disclosed

2026-05-04

Vendor

Microsoft

Product

Microsoft 365 Copilot; Consumer Copilot

Risk domain

Reliability and observability › Data and memory poisoning

Also touches

Privilege escalation, Data exfiltration channels, Confused deputy

System type

Generative model

Who acted

Agent acted — Copilot rendered, wrote memory and persisted the backdoor

Attack surface

Enterprise assistant

Autonomy level

Assistant

Initial vector

Indirect prompt injection content

Impact type

Data exfiltration, Memory poisoning, Persistence, Persistent memory poisoning

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI06 – Memory & Context Poisoning
MITRE ATLAS: AML.T0020 – Poison Training Data
NIST AI RMF: MEASURE 3.1
EU AI Act: Article 15
ISO/IEC: TR 24028; 24029-1; 23894
AIUC-1: D. Reliability
Scope: agent failure
Mitigation: Monitor model performance; Implement feedback diversity and circuit breakers.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

M365 Copilot and consumer Copilot users

Capability abused

html_preview_renderingdelayed_tool_invocationlong_term_memory_writeretrievalmemory_write

Defense & remediation

Recorded defense

Microsoft Copilot injection classifiers and link/render restrictions

Guardrail kinds

Input classifier

Guardrail outcome

Silent

Fix shipped

CVE-2026-24299 assigned; Microsoft fix associated with the CVE

Curator notes

Johann Rehberger, talk given at DEF CON Singapore 2026; blog post 4 May 2026. The chained result - exfiltration plus memory hijack equals a persistent backdoor in a shipped enterprise assistant - is the significant part. Successor to the 2024 'Living off Microsoft Copilot' line of work by Michael Bargury (see quarantine). Also reported as: 'Copirate 365: HTML-preview and memory-based data exfiltration from Microsoft Copilot (CVE-2026-24299)'.

Cite as

Enkrypt AI. "Copirate 365 at DEF CON: data exfiltration, memory hijacking and a persistent backdoor in Microsoft Copilot (CVE-2026-24299)". AIR, AIR-2026-0100. https://agentincident.vercel.app/i/AIR-2026-0100/ (accessed 2026-10-19).