Citation :
Last Tuesday, Microsoft patched a vulnerability it rated as max critical in its M365 Copilot AI platform. On Monday, the researchers who discovered the vulnerability and reported it to Microsoft revealed how their proof-of-concept exploit could retrieve 2FA codes and other sensitive data from emails accessible to Copilot.
...
The researchers wrote:
So, the sequence looks like this:
Copilot starts streaming its response, which includes an <img> tag
The browser sees the <img>, renders it, and fires off an HTTP request to the src URL
Copilot finishes generating. The guardrail wraps everything in <code>
Too late! The request already left.
|
