Details have surfaced regarding a previously undisclosed vulnerability in Microsoft 365 Copilot that could have enabled attackers to steal sensitive user data through a novel technique known as ASCII smuggling. This vulnerability, now patched, underscores the potential risks associated with the use of artificial intelligence (AI) tools.
What is ASCII Smuggling?
ASCII smuggling is a technique that leverages special Unicode characters that appear identical to ASCII characters but are invisible in the user interface. Security researcher Johann Rehberger explained that this method allows attackers to embed invisible data within clickable hyperlinks, effectively staging the data for exfiltration without the user’s awareness.
The Exploit Chain
The attack method exploits several techniques to form a reliable exploit chain:
- Trigger Prompt Injection: Malicious content is concealed in a document shared within the chat, initiating the attack.
- Prompt Injection Payload: Copilot is manipulated into searching for additional emails and documents.
- ASCII Smuggling: Attackers use invisible characters to embed hyperlinks that entice the user into clicking, thus exfiltrating valuable data to a third-party server.
The attack can result in the exfiltration of sensitive information, including multi-factor authentication (MFA) codes, potentially transmitted to a server controlled by an adversary.
Addressing the Vulnerability
Microsoft has patched the vulnerability following a responsible disclosure made in January 2024. This remediation highlights the importance of monitoring and securing AI tools to prevent data breaches.
Broader Implications
The ASCII smuggling vulnerability in Microsoft 365 Copilot comes amid a rise in proof-of-concept (PoC) attacks against Microsoft's Copilot system. These attacks showcase how malicious actors can manipulate AI-driven systems, exfiltrate private data, and bypass security measures.
Researchers from Zenity have demonstrated methods like retrieval-augmented generation (RAG) poisoning and indirect prompt injection to achieve remote code execution. These tactics could allow attackers to fully control Microsoft Copilot and similar AI applications, possibly leading to spear-phishing campaigns.
Preventative Measures
Enterprises are advised to assess their exposure to data leakage risks from Copilots, formerly known as Power Virtual Agents. Implementing security measures like Data Loss Prevention (DLP) and other controls to manage Copilot creation and publication can help mitigate such risks. Monitoring AI interactions and securing publicly exposed Copilot bots with authentication can further protect against potential exploitation.
As AI tools become increasingly integrated into business operations, understanding their vulnerabilities is crucial. Microsoft's quick response to patch the ASCII smuggling vulnerability in Copilot demonstrates the need for ongoing vigilance and proactive security measures to safeguard sensitive information from evolving cyber threats.
