The AI Assistant’s Betrayal: One-Click for AI to Turn into the Perfect Insider
summary
Researchers disclose two one‑click flaws in Microsoft Copilot: RePrompt abuses a Q URL parameter in Copilot Personal to auto‑execute injected prompts that concat secrets into attacker URLs for simple exfiltration, using a double requests trick to bypass guardrails; Search Leak targets M365 Copilot by rendering attacker-crafted HTML (SSRF + image endpoint) to funnel calendar, email and MFA data through Bing's renderer. Both issues allow staged/chain exfiltration, gained critical CVEs, and receive vendor fixes.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:11AI bots history
- 7:37AI assistants types
- 8:22Prompt injection flaws
- 10:31Copilot Personal flaw
- 16:17One-click danger
- 17:43Chain request flaw
- 22:05Chain attack demo
- 26:58Copilot Enterprise leak
- 32:41Search leak demo
- 35:13AI flaw impact
- 36:40AI threats growth
- 37:22Security tips
- 38:26Vendor recommendations
- 39:51Conclusion
related talks
49mLiving off Microsoft Copilot
43mWho to blame? The AI, The Programmer, or The Prompt?
26mCopilot trust & safety: Controls to manage AI risk
31mPiloting Edge Copilot
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
51mHow to Safely Deploy AI Copilots
54mA Practical Guide to AI Threats & Mitigation Strategies
56mAttacking AI