Copirate 365: Researcher Demos Data Exfil in Microsoft Copilot via Font Loading
wunderwuzzi23 · x · 2026-09-05
Security researcher wunderwuzzi released the talk "Copirate 365: Plundering in the depths of Microsoft Copilot", a survey of Microsoft Copilot security weaknesses with live demos:
- A brief history of AI data exfiltration exploits over the past 3+ years
- Data exfil across M365 Copilots via font loading, encoding stolen data in external font requests
- Memory writes + "SpAIware": planting persistent instructions for spyware-like behavior
- Consumer Copilot exploits
The full talk is available on YouTube.
More from Safety
- India needs an "AI defence force": experts warn of agent swarms and AI worms — ravi_iitm · 2026-10-23
- DeepSeek US ban covers self-hosted weights, not just the app — AIFlow_ML · 2026-10-23
- Uncensored fine-tunes vanish from Hugging Face amid unexplained takedowns — umarmnaq · 2026-10-23
- Gmail's AI scans your emails and attachments by default; here's how to turn it off — alifcoder · 2026-10-23
- Typosquatted Blender MCP Repo Hit 958 Stars in Days and Silently Ran Malware — Promptmethus · 2026-10-23
- Prompt injection scanners should be positional, not phrasal: same string, different blast radius — mrpkk · 2026-10-23