ASCII smuggling vulnerability in Microsoft 365 Copilot enabled data theft
A vulnerability in Microsoft 365 Copilot used ASCII smuggling techniques to extract sensitive data from emails, including multi-factor authentication codes. Researchers discovered the flaw could be exploited via prompt injection and invisible hyperlinks to exfiltrate data to attacker-controlled servers. Microsoft patched the vulnerability following responsible disclosure in January 2024.
What happened
Cybersecurity researchers discovered a vulnerability in Microsoft 365 Copilot that used ASCII smuggling—a technique employing special unicode characters invisible in the user interface—to exfiltrate sensitive data.
The attack chain involved triggering prompt injection via malicious content in shared documents, instructing Copilot to search for additional emails and documents, then using ASCII smuggling to embed invisible data in clickable hyperlinks to send it to attacker-controlled servers.
Sensitive information from emails, including multi-factor authentication codes, could be extracted and sent to third parties if attackers had prior knowledge of the Copilot's name or URL.
Reported impact
The vulnerability exposed the potential for data theft of sensitive information, including passwords and multi-factor authentication codes, from Microsoft 365 users.
Zenity outlined that the attack methods could enable retrieval-augmented generation poisoning and indirect prompt injection attacks, potentially leading to remote code execution and full system compromise.
Index analysis
The vulnerability combined prompt injection with ASCII smuggling—an invisible Unicode technique—to deceive users and exfiltrate data without visible indicators.
Security researcher Johann Rehberger recommended that enterprises evaluate their risk tolerance and enable Data Loss Prevention and security controls to prevent data leaks from Copilots and similar applications.
Governance controls
Microsoft patched the vulnerability following responsible disclosure in January 2024.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.