Microsoft 365 Copilot Data Theft via ASCII Smuggling
On this page
Before EchoLeak, the same idea in miniature: get Copilot to find your secrets, then smuggle them out in invisible characters.
| When | August 2024 |
|---|---|
| Target | Microsoft 365 Copilot |
| Vendor | Microsoft |
| Researcher | Johann Rehberger (Embrace The Red) |
| Technique | Indirect injection + tool use + ASCII-smuggled exfil |
| Disclosed | Reported to MSRC Jan 2024; fixed 2024 (no CVE) |
- 1An injected email or document tells Copilot to search the victim's mailbox and files
- 2Retrieved secrets are hidden with invisible “ASCII smuggling” Unicode inside a link
- 3The user clicks the innocuous-looking link and the hidden data is sent to the attacker
What happened
In 2024 — before EchoLeak — Johann Rehberger demonstrated an indirect-injection chain against Microsoft 365 Copilot. A malicious email or shared document instructed Copilot to search the victim's mailbox and files for sensitive content (in the demo, even a Slack MFA confirmation code). The retrieved data was staged with “ASCII smuggling” — invisible Unicode tag characters — inside a clickable hyperlink; clicking it sent the hidden data to an attacker-controlled server. Reported to MSRC in January 2024 and fixed during 2024.
How the attack worked
Copilot had legitimate access to the victim's data; the injection redirected that access, then hid the loot in characters the user can't see and shipped it out through a rendered link.
Root cause
Untrusted content drove privileged retrieval, and model output could carry hidden data to external hosts — the same shape EchoLeak would later exploit zero-click.
What a test would have caught
An injection that asks the assistant to gather data and emit a link — plus a check for invisible-Unicode staging in its output — surfaces both the retrieval abuse and the exfil channel.
How to prevent it
- Isolate untrusted content from privileged retrieval.
- Strip invisible Unicode from model output.
- Constrain and allowlist rendered links — Microsoft did not detail its fix, but Rehberger saw Copilot stop rendering links.
Feel it yourselfThe replay lab lets you leak an assistant's context through a rendered link/image — the exfil channel abused here.
FAQ
What is “ASCII smuggling”?
Encoding data using invisible Unicode “tag” characters so it rides inside otherwise-normal-looking text or a link — the victim sees nothing unusual, but the hidden payload carries their data out when the link is clicked.
How did Copilot get the data in the first place?
An injected email or document instructed Copilot to search the victim's own mailbox and files for sensitive content — it had legitimate access, and the injection redirected that access.
Was this exploited in the wild?
It was responsible-disclosure research reported to Microsoft, which remediated it without publishing details (Rehberger saw Copilot stop rendering links) so the demonstrated exploits no longer work.
Sources
- Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information — Embrace The Red
- Microsoft Fixes ASCII Smuggling Flaw That Enabled Data Theft from Microsoft 365 Copilot — The Hacker News
- Microsoft 365 Copilot Vulnerability Exposes User Data Risks — Infosecurity Magazine