- ID
- AIA-007
- Category
- AI AI agent incident
- Disclosed
- 2024-08
- Systems
- Microsoft 365 Copilot
- Harm type
- Data leak / prompt injection
- Status
- reported
Reported by the source; no vendor confirmation recorded in seed data.
Summary
Embrace The Red (Johann Rehberger) showed how an email could make Copilot invoke tools and hide data in invisible Unicode links. He shared the exploits with Microsoft in January and February 2024. He reports that his exploits no longer work and that Microsoft did not share the details of the fix.
Controls
Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.
NIST AI RMF
- MEASURE 2.7 Security and resilience are evaluated and documented
- MAP 4.1 Risks from third-party components are mapped
NIST SP 800-53
- AC-4 Information Flow Enforcement
- SI-10 Information Input Validation
- SI-15 Information Output Filtering
Human-approval (JCR) checkpoint
Sources
- embracethered.com primary link checked 2026-10-31, HTTP 200
Published 2024-08-26
https://embracethered.com/blog/posts/2024/m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling/
Corrections
- Verification round 1: date month confirmed (published 2024-08-26). Replaced "He reports that Microsoft applied fixes" with "He reports that his exploits no longer work and that Microsoft did not share the details of the fix", which matches the source; added the January/February 2024 disclosure.
To report an error in this entry, see corrections.