Redazione RHC:23 October 2025 13:30
An advanced security flaw exists in M365 Copilot that allows attackers to exfiltrate sensitive information from tenants, such as recent emails, through indirect command injection.
Security researcher Adam Logue detailed a vulnerability in a recently published blog post. This vulnerability, thanks to the integration of the AI assistant into Office documents and native support for Mermaid diagrams, allows data leakage with a single initial click by the user, without requiring further interaction.
The attack begins when a user asks M365 Copilot to summarize a specially created Excel spreadsheet. Hidden instructions, embedded in white text across multiple sheets, use progressive task editing and nested commands to hijack the AI’s behavior.
Indirect prompts replace the summary task, instructing Copilot to invoke its search_enterprise_emails tool to retrieve recent business emails. The retrieved content is then hexadecimal encoded and broken into short lines to circumvent Mermaid’s character limits.
Copilot generates a Mermaid Diagram, a JavaScript-based tool for creating flowcharts and diagrams from Markdown-like text that masquerades as a “login button” protected by a padlock emoji.
The diagram includes CSS styling for a convincing button appearance and a hyperlink embedding encrypted email data. When the user clicks the link, believing it is required to access the document’s “sensitive” content, it redirects to the attacker’s server. The hexadecimal-encoded payload is transmitted silently, where it can be decoded from server logs.
Adam Logue noted similarities to an earlier Mermaid exploit in Cursor IDE, which allowed for clickless exfiltration via remote images, although M365 Copilot required user interaction.
After extensive testing, the payload was inspired by Microsoft’s TaskTracker research into detecting task drift in LLMs. Despite initial difficulties reproducing the problem, Microsoft validated the chain and fixed it by September 2025, removing interactive hyperlinks from the Mermaid diagrams rendered by Copilot.
The timeline of findings shows that there were coordination difficulties. Adam Logue reported the full situation on August 15, 2025, after discussions with Microsoft Security Response Center (MSRC) staff at DEFCON.
Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.