Microsoft CoPilot - Attacks - Part 2

How Abuse of Microsoft Copilot Maps to the Attack Matrices

MITRE ATLAS (atlas.mitre.org) 

Mitre Atlas is the ATT&CK-style knowledge base purpose-built for adversarial tactics against AI/ML systems. As of the current release it organizes techniques into 16 tactics run in rough attack-progression order:

Reconnaissance → Resource Development → Initial Access → AI Model Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → AI Attack Staging → Command and Control → Exfiltration → Impact. 

Copilot abuse cases in this exercise touch nearly every one of these. For example, a single Copilot exploit chain (e.g., EchoLeak) can span Resource Development, Initial Access, Execution, Privilege Escalation, Defense Evasion, and Exfiltration in one uninterrupted flow, entirely inside the M365 trust boundary, without ever tripping a traditional "intrusion."

OWASP Top 10 for LLM Applications (2026)

OWASP Top 10 for LLM Applications ranks the ten most critical application-layer risks for systems built on LLMs, based on practitioner consensus plus real-world incident data:

Rank	Category
LLM01	Prompt Injection
LLM02	Sensitive Information Disclosure
LLM03	Excessive Agency
LLM04	Supply Chain
LLM05	Data and Model Poisoning
LLM06	Unbounded Consumption
LLM07	Misinformation
LLM08	Hidden Context Exposure (renamed from System Prompt Leakage)
LLM09	Vector and Embedding Weaknesses
LLM10	Improper Output Handling

OWASP Top 10 for LLM Applications (2026) - Notes

• Notably, Excessive Agency jumped from 6th to 3rd place in the 2026 edition, OWASP's own framing is that this is "the most consequential move on the list," reflecting exactly the Copilot risk this exercise focuses on: an LLM that can search, retrieve, cite, and act with a user's full Graph permissions is a fundamentally different risk than a chatbot that only answers questions.

• Prompt Injection stays at #1 specifically because, as OWASP notes:

"you cannot filter your way out of prompt injection, you have to bound what a compromised model is allowed to reach."

OWASP Top 10 for Agentic Ai

Published by the OWASP GenAI Security Project, the Top 10 for Agentic Applications (2026) is a risk-classification framework built specifically for AI systems that don't just answer questions but act, invoking tools, carrying memory across sessions, and taking multi-step autonomous actions on a user's or organization's behalf. Where the OWASP LLM Top 10 focuses on vulnerabilities in the model-as-application layer (prompt injection, sensitive data disclosure, output handling), the Agentic Top 10 (ASI01–ASI10) focuses on what goes wrong once that model becomes an actor with privilege and consequence: goal hijacking, tool misuse, identity and privilege abuse, supply-chain exposure in agent plugins/connectors, unexpected code execution, memory and context poisoning, insecure agent-to-agent communication, cascading failures, human over-trust in agent output, and rogue agents that persist while appearing legitimate. OWASP's own framing is that this shift matters because an agent's autonomy, not just its language capability, is what turns an application-layer bug into a business-impact incident.

Rewritten paragraph — how all three frameworks relate

MITRE ATLAS, the OWASP LLM Top 10, and the OWASP Agentic Top 10 each answer a different question about the same incident, and using all three together is what makes the picture complete. ATLAS describes the adversary's attack lifecycle — what an attacker actually does, step by step, from reconnaissance through exfiltration. The OWASP LLM Top 10 describes the application-layer vulnerability class that lifecycle exploits — the root-cause bug category, like prompt injection or sensitive information disclosure. The OWASP Agentic Top 10 adds the third dimension: which property of the agent's autonomy and privilege turned that vulnerability into real-world impact — for example, why a prompt injection became a fraudulent wire transfer instead of a harmless wrong answer. A single Copilot incident typically maps to one OWASP LLM root-cause category (usually LLM01 Prompt Injection as the initiating flaw), touches several ATLAS tactics as the attack unfolds, and traces its business impact back to one or more Agentic risks (commonly ASI01 Agent Goal Hijack, ASI03 Identity & Privilege Abuse, and ASI09 Human-Agent Trust Exploitation, chained together).

AI Abuse & Attack Techniques - Overview

"you cannot filter your way out of prompt injection, you have to bound what a compromised model is allowed to reach."

Instruction telling the model "only use this one source, ignore the others" arrives through the same channel as the retrieved documents it's instructing the model about. There's no structural separation that would let the model say "an instruction about which document to trust can't itself come from inside a document", because to the model, it's all just data the stream.

None of the mitigations in that rely on the model "just being smarter" about what to trust will fully close this gap, because the trust signal doesn't exist in the channel to begin with. That's why the stronger controls are architectural, index-based browsing, egress allowlisting, provenance labeling before the content reaches the context window, rather than prompt-level instructions telling Copilot to "be careful."

AI Abuse & Attack Techniques Leveraged Against Microsoft Copilot

This table synthesizes the Copilot-specific abuse patterns described in the Guardz "M365 Copilot Attack Surface" research alongside the two standard classification matrices.

#	Copilot Abuse Pattern (plain-language)	MITRE ATLAS Tactic	Representative ATLAS-style Technique	OWASP Top 10 for LLM (2026)
1	Using Copilot's own natural-language search to quietly enumerate sensitive files/emails ("pull every doc with keyword M&A")	Reconnaissance / Discovery	RAG-powered enumeration; Gather RAG-Indexed Targets	LLM02 – Sensitive Information Disclosure
2	Hiding attacker instructions in document metadata, footers, comments, or Markdown that Copilot ingests but a human reviewer wouldn't notice	Initial Access	Retrieval Content Crafting; RAG Poisoning	LLM01 – Prompt Injection
3	Zero-click exfiltration via auto-rendered images/fonts/links in a Copilot response (no user click required)	Exfiltration	Image Rendering; Web Request Triggering	LLM01 – Prompt Injection; LLM02 – Sensitive Info Disclosure
4	Getting Copilot to embed stolen data in a "helpful" citation link or footer the user is enticed to click	Exfiltration	Clickable Link Rendering; Abuse Trusted Sites	LLM02 – Sensitive Information Disclosure
5	Telling Copilot not to show citations/references so a query against sensitive files leaves no audit trail	Defense Evasion	Citation Silencing	LLM03 – Excessive Agency (unbounded/unlogged action)
6	Instructing Copilot to reference only the attacker's planted content, so the legitimate source is buried	Defense Evasion	False RAG Entry Injection; Citation Manipulation	LLM01 – Prompt Injection
7	Persisting a malicious instruction into Copilot's long-term memory so it re-triggers in future, unrelated sessions	Persistence	Memory Poisoning; AI Agent Context Poisoning	LLM01 – Prompt Injection (indirect); LLM03 – Excessive Agency
8	Encoding stolen data (Base64, Unicode Tag smuggling) inside an otherwise normal-looking Copilot answer to bypass DLP keyword/regex matching	Exfiltration / Defense Evasion	ASCII Smuggling; LLM Data Leakage	LLM02 – Sensitive Information Disclosure
9	Hijacking Copilot's answer to a legitimate business question (e.g., "what are the vendor's bank details?") to insert attacker-controlled data	Execution / Impact	LLM Jailbreak; LLM Trusted Output Components Manipulation	LLM03 – Excessive Agency; LLM07 – Misinformation
10	Using Copilot's summarization/"most relevant files" ranking to have it auto-curate and package the highest-value data for theft	Collection	RAG Data Harvesting; Data Weighted File Copy	LLM02 – Sensitive Information Disclosure
11	Consent-phishing via a malicious "Copilot plugin" requesting broad Graph permissions (Mail.ReadWrite, Files.ReadWrite.All, etc.)	Initial Access / Persistence	AI Supply Chain Compromise; AI Agent Tool Poisoning	LLM04 – Supply Chain

SSRF Analogies to AI Attacks

Classic SSRF

A server-side component has privileged network access (it can reach internal metadata endpoints, internal-only services, localhost). It accepts a URL from the outside world and fetches it using that privileged access, with no check on whether the URL's target is one the requester should be allowed to reach. The server isn't compromised, it's doing exactly what it was built to do (fetch a URL). It's just doing it on behalf of someone who was never supposed to control the destination.

In prompt injection / tool abuse

The LLM agent has privileged access too, Copilot's Graph permissions, a coding agent's shell access, a support bot's database read. It ingests content from the outside world (an email, a document, a web page) and acts on instructions found in that content, using its own privileged access, with no check on whether the source of those instructions should be allowed to direct that action. The model isn't "hacked" in any traditional sense, it's doing exactly what it was built to do (follow instructions in its context). It's just following instructions from someone who was never supposed to be giving it any.

That's exactly why security researchers reach for the SSRF comparison rather than something newer: SSRF already forced the industry through the corresponding lesson two decades ago, you cannot fully input-validate your way out of it. Blocklisting bad hostnames gets bypassed by redirects, DNS rebinding, decimal/octal IP encoding. The fix that actually held was architectural: egress allowlisting, network segmentation, disabling automatic redirects. Prompt injection is following the identical arc, pattern/keyword filtering on prompts gets bypassed by encoding, indirection, multi-turn framing (several of the cases in the tabletop doc use exactly this), so the mitigations that are actually sticking are architectural too: index-based browsing, egress allowlisting on the model's fetch capability, provenance labeling before content reaches the model.

Public, Documented Examples of Microsoft Copilot Abuse

Each of these is a real, publicly disclosed vulnerability chain or red-team procedure. All have been reported to Microsoft; most are patched as of the cited dates.

Case	What Happened	Primary ATLAS Tactics	OWASP Mapping
EchoLeak (CVE-2025-32711) — zero-click, M365 Copilot	Attacker emails a victim. The email contains hidden prompt-injection text disguised as normal content. When the victim later asks Copilot to "summarize the latest earnings reports," Copilot's RAG pipeline also retrieves the malicious email, follows its embedded instructions, and embeds sensitive financial data inside a Markdown image URL pointed at a trusted Microsoft domain (teams.microsoft.com relay). The image auto-loads, no click required, and the data leaves the tenant.	Resource Development → Initial Access (RAG Poisoning) → Execution (Prompt Injection) → Privilege Escalation (Jailbreak) → Defense Evasion (Abuse Trusted Sites) → Exfiltration (Image Rendering)	LLM01 Prompt Injection; LLM02 Sensitive Information Disclosure
"Copirate 365" / HTML Preview & Memory Exfiltration (CVE-2026-24299) — Johann Rehberger, DEF CON	A shared Word/Excel document contains hidden instructions. When the victim opens it and Copilot summarizes it, the injected text causes Copilot to render an HTML preview with a CSS @font-face or background-image pointing to an attacker server, silently exfiltrating data as the font/image loads. A follow-on variant plants a persistent instruction into Copilot's record_memory, so that every future conversation, including ones months later, involving unrelated documents , automatically leaks any password, code, or secret the user later types, until the memory entry is manually found and removed. Microsoft's own documentation confirmed memory read/write actions generate no Purview audit log entries.	Initial Access (RAG Poisoning) → Execution (Prompt Injection) → Persistence (Memory Poisoning) → Defense Evasion (Delay Execution / Conditional Trigger) → Exfiltration (Web Request Triggering)	LLM01 Prompt Injection; LLM02 Sensitive Info Disclosure; LLM03 Excessive Agency
SearchLeak (CVE-2026-42824) — Varonis Threat Labs, M365 Copilot Enterprise Search	A crafted link to a trusted microsoft.com URL embeds a prompt directly in the q= search parameter. One click (no further interaction) causes Copilot to search the victim's mailbox/calendar/SharePoint, embed the results in an <img> tag, and — via a timing race condition in the HTML sanitizer plus an SSRF through Bing's "search by image" endpoint (which is CSP-allowlisted) — exfiltrate the data to an attacker server before the sanitizer neutralizes the payload.	Resource Development (Acquire Infrastructure) → Initial Access (Parameter-to-Prompt Injection) → Defense Evasion (CSP/Allowlist Abuse, race condition) → Exfiltration (SSRF via trusted domain)	LLM01 Prompt Injection; LLM02 Sensitive Info Disclosure; LLM08 Hidden Context Exposure
CoSnitch (CVE-2026-24301) — Varonis, Copilot Personal (consumer)	An undocumented autorun=1 URL parameter, combined with the documented q= chat-prefill parameter, causes Copilot to execute an attacker's prompt the instant a crafted link loads — no click-to-send needed. The prompt directs Copilot to pull data from connected personal accounts (Gmail, Drive, Calendar) via the victim's existing OAuth grants and exfiltrate it disguised as ordinary "summarize this URL" traffic. Also writes a persistent memory-poisoning foothold that survives password changes and session revocation. Notably discovered via "meta-hacking" — researchers simply asked Copilot to explain why the exploit shouldn't work, and its own explanations revealed the exact parameters needed.	Reconnaissance (Discover AI Agent Configuration, via self-explanation) → Initial Access (Parameter Injection) → Execution (Prompt Injection) → Persistence (Memory Poisoning) → Exfiltration (Abuse Trusted Sites)	LLM01 Prompt Injection; LLM02 Sensitive Info Disclosure; LLM08 Hidden Context Exposure
Copilot M365 Lures Victim to a Phishing Site (BHUSA24 research)	An email containing hidden instructions is indexed by Copilot. When the victim later asks a legitimate, unrelated question ("how do I access the Power Platform admin center?"), the injected instructions hijack Copilot's answer, suppress any mention of the injection, and cause Copilot to confidently output a link to an attacker-controlled lookalike domain, styled as an official citation.	Execution (Prompt Injection) → Privilege Escalation (Jailbreak) → Defense Evasion (Instructions Silencing, False RAG Entry Injection, Citation Manipulation) → Impact (user directed to phishing site)	LLM01 Prompt Injection; LLM03 Excessive Agency; LLM07 Misinformation
Financial Transaction Hijacking — Copilot as Insider (BHUSA24 research)	Same injection mechanism as above, but the hijacked answer is to a finance employee's legitimate question — "what are the bank details for [vendor]?" Copilot is manipulated into citing only the attacker's planted email (fraudulent bank details) while suppressing the legitimate vendor file, producing a confident, well-cited, entirely wrong answer that leads directly to a fraudulent wire transfer.	Execution (Prompt Injection) → Privilege Escalation (Jailbreak) → Defense Evasion (Citation Manipulation, Instructions Silencing) → Impact (financial loss)	LLM01 Prompt Injection; LLM03 Excessive Agency; LLM07 Misinformation
ASCII Smuggling / Personal Info Exfiltration (Embrace The Red)	A malicious email/document instructs Copilot to find a specific other email and re-encode its body using invisible Unicode Tag characters embedded in a URL, which it then presents as an innocuous-looking clickable link ("click here for details"). One click by the victim silently transmits the invisible, encoded email contents to the attacker.	Initial Access (RAG Poisoning) → Execution (Prompt Injection) → Defense Evasion (Conditional Execution, ASCII Smuggling) → Collection (RAG Data Harvesting) → Exfiltration (Clickable Link Rendering)	LLM01 Prompt Injection; LLM02 Sensitive Info Disclosure; LLM10 Improper Output Handling
Purview Audit Log Evasion / DLP Bypass ("Living off Copilot," BHUSA24)	A user (insider or compromised account) simply asks Copilot to find files matching a sensitive keyword (e.g., "salaries") but explicitly instructs it not to print citations/references. Copilot answers with the file names/content but — because no citation is rendered — Purview's DLP/audit mechanism, which keys off citation rendering, never logs that the underlying sensitive files were accessed.	Resource Development (Prompt Crafting, using prior knowledge of how citations render) → Execution (Prompt Injection) → Defense Evasion (Citation Silencing) → Collection (RAG Data Harvesting, unlogged)	LLM02 Sensitive Info Disclosure; LLM03 Excessive Agency

References

• Guardz, "Unpacking the Microsoft 365 Copilot Attack Surface"

• Varonis Threat Labs, "SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon"

• Johann Rehberger / Embrace The Red, "Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)"

• Cloud Security Alliance, "CoSnitch: One-Click Data Exfiltration in Copilot Personal" (CVE-2026-24301)

• AI Agents Attack Matrix (ttps.ai), procedures: Purview Audit Log Evasion / DLP Bypass, Copilot M365 Lures Victims Into a Phishing Site, EchoLeak: Zero-Click Data Exfiltration, Prompt Injection to Exfiltration of Personal Information, Financial Transaction Hijacking With M365 Copilot As An Insider; mitigation: Index-Based Browsing

• MITRE ATLAS (atlas.mitre.org) — 16-tactic adversarial ML threat matrix

• OWASP GenAI Security Project, Top 10 for LLM Applications 2026

• Microsoft Fixes Critical Copilot Flaw Which Enabled One-Click Data Theft | LinkedIn

  Varonis: CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower

• MCP: https://medium.com/design-bootcamp/mcp-is-dead-ece45c1f80bb

• MCP: https://www.redhat.com/en/blog/model-context-protocol-mcp-understanding-security-risks-and-controls