Adam Logue personal blog
Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
- Points
- 218
- HN comments
- 49
- Submissions
- 1
- Cited by
- 0 commenters
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Oct 26, 2025 | Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams by gnabgib | 218 | 49 |
