Official Microsoft security advisories or announcements

Microsoft Fixes High-Severity ASCII Smuggling Vulnerability in 365 Copilot

Aug 27, 2024, 06:10 AM

Microsoft has addressed a high-severity vulnerability in its Microsoft 365 Copilot, which was capable of exploiting ASCII smuggling to exfiltrate sensitive user data. The flaw, which was reported earlier this year, allowed phishing emails to use prompt injection to steal personally identifiable information (PII), including the contents of entire emails and other documents. This vulnerability highlighted the potential risks associated with advanced AI applications and the importance of securing collaborative platforms. The fix underscores Microsoft's commitment to cybersecurity and protecting user data from potential breaches.