Living off Microsoft Copilot
summary
Demonstrates a red-team–grade exploit chain: Copilot plugins can install a persistent backdoor into other users’ Copilot interactions, allowing data theft and AI-driven social engineering; a demo replaces vendor banking details while preserving bogus file references so no DLP logs appear; automated spear‑phishing is built and deployed with LOLCopilot which runs in default M365 tenant configurations; exfiltration techniques use prompt injection and controllable RAG references; the delivered tool works in demos and the talk ends with concrete detection and hardening steps.
AI-written summary · about
chapters (16)
- 0:00Copilot risks and demo
- 1:50AI accountability history
- 3:54Speakers and context
- 7:10Copilot defense mechanisms
- 13:54Jailbreaks significance
- 18:13Code execution on Copilot
- 22:27Post-compromise techniques
- 24:16Remote Copilot Execution threats
- 25:40Ways into Copilot graph
- 29:37Microsoft AI security challenges
- 31:45Output manipulation impact
- 35:40Jailbreaking techniques
- 41:04Controlling Copilot references
- 43:33Demo Remote Copilot Execution
- 43:54Key takeaways
- 46:44Data exfiltration via Bing
related talks
43mThe AI Assistant’s Betrayal: One-Click for AI to Turn into the Perfect Insider
26mCopilot trust & safety: Controls to manage AI risk
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
51mHow to Safely Deploy AI Copilots
45mExploring Copilot Capabilities
13mPower Control and Security: Limitless with Microsoft Copilot Studio
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
23mKEYNOTE: From Copilot to Flight Captain