Researcher Demonstrates Copilot Data Theft Through Font Requests and Poisoned Memory

Summary

Researcher Johan demonstrates how prompt injection in M365 Copilot can poison user memory and leak secrets through remote font requests. The chain combines a CSP bypass with persistent instructions that trigger in later conversations.

Key points

The demonstrated chain targets enterprise M365 Copilot, using instructions embedded in documents to redirect the assistant rather than requiring macros or executable downloads.
HTML previews could load remote fonts despite image restrictions, allowing sensitive data to be encoded in the font request URL and sent to a researcher-controlled server.
Johan demonstrates delayed tool invocation: a document summary asks a follow-up question, and the user's reply triggers storage of injected instructions in Copilot memory.
The poisoned memory is user-specific, not organization-wide, but can influence that user's later conversations across M365 Copilot experiences.
In the end-to-end demonstration, a password mentioned in a subsequent conversation triggers HTML rendering and exfiltration through a font request.
Johan reports that Microsoft removed prompt-driven automatic preview behavior after disclosure. He also describes fixes and regressions in the desktop experience; the transcript does not establish complete remediation of the chain.
A separate training lab demonstrates indirect prompt injection to retrieve cloud metadata credentials and leak them through an image request, while highlighting the need to verify actual tool calls rather than trust hallucinated output.

Article Details

Topics: [02:00] Persistent data exfiltration through user-specific AI memory
[07:01] Enterprise M365 Copilot attack surface and tool discovery
[10:25] HTML previews and remote-font CSP bypass
[13:48] Document-based exfiltration demonstrations and cross-application behavior
[21:40] Memory poisoning through delayed tool invocation
[26:32] Combining poisoned memory with font-based secret exfiltration
[30:16] Training lab: tool inspection, cloud metadata access, and indirect injection
[41:17] Side-channel exfiltration through limited outputs and emoji reactions

People

JohanGuest security researcher who demonstrates M365 Copilot prompt injection, remote-font data exfiltration, and persistent memory poisoning. He describes reporting the research to Microsoft and observing subsequent behavior changes.

Vendors

Microsoft[00:01] Microsoft Copilot with a word document.

Products

Excel[00:59] triggers it. Word, Excel, Outlook,M365 Copilot[21:22] copilot M365 copilot and you can like Microsoft PowerPoint[19:03] PowerPoint, Excel, Word, SharePoint Microsoft SharePoint[01:01] SharePoint, any of them, it works and Outlook[00:59] triggers it. Word, Excel, Outlook,Word[00:01] Microsoft Copilot with a word document.