Microsoft 365 Copilot Flaw Lets Hackers Steal Sensitive Data via Indirect Prompt Injection

A vulnerability in Microsoft 365 Copilot allowed attackers to trick the AI assistant into fetching and exfiltrating sensitive tenant data by hiding instructions in a document, with the data then being encoded into a malicious Mermaid diagram. The attack used Copilot’s built-in search tool to retrieve the victim’s recent emails, hex-encoded them, and rendered a fake “Login” button as part of the diagram, which when clicked sent the data to an attacker’s server.

Clicking the button caused a hidden iframe to briefly display an HTTP response from the attacker’s server, helping to make the exfiltration seem credible. The researchers’ report explains that indirect prompt injection occurs when attackers embed instructions in external content that the AI trusts, enabling hidden commands to override intended behavior.

After a responsible disclosure, Microsoft patched Copilot to disable interactive elements like hyperlinks in Mermaid diagrams, effectively closing the exfiltration channel. Users are advised to update their Copilot integrations and avoid summarising untrusted documents until the patch is applied, according to GBHackers On Security.