Rubrik Researchers Detail Microsoft Copilot Sandbox Escape
Rubrik Zero Labs described an exploit chain at Black Hat USA 2026 in which a poisoned Word document progressed from prompt injection to an escape from a Microsoft Copilot sandbox. Forkast ties the path-traversal stage to CVE-2026-32193, while SiliconANGLE reports that Microsoft fixed the demonstrated flaw before the research became public.
Rubrik Zero Labs security researcher Ori Lahav presented research at Black Hat USA 2026 describing an exploit chain against Microsoft 365 Copilot that began with a malicious Word document and culminated in an escape from an Azure-hosted sandbox. Rubrik calls the technique Remote Prompt Execution, and its event page describes a scenario in which a document upload can lead to control of a Copilot chat session.
The demonstration combined prompt injection with a cloud infrastructure vulnerability. Forkast describes five stages: hiding instructions in a Word document, bypassing the model's safety classification, escalating privileges in the Copilot sandbox, exploiting a path-traversal flaw in Azure Container Apps dynamic sessions, and using LD_PRELOAD to escape to the underlying host. Forkast identifies the path-traversal issue as CVE-2026-32193.
Access through a live assistant session
Forkast reports that, after the sandbox escape, the chain created a bidirectional channel that could inject prompts into a victim's active Copilot session and read responses. Because a Copilot session can operate with the user's identity and access to connected enterprise resources, the reported risk included Microsoft 365 and Azure data available under that user's permissions.
SiliconANGLE reported that Rubrik Zero Labs discovered the issue in February and disclosed it to Microsoft before publishing its findings. Joe Hladik, head of Rubrik Zero Labs, told SiliconANGLE that Microsoft had fixed the demonstrated flaw by mid-March. Forkast ties the Azure path-traversal CVE to Microsoft's June 2026 security update, gives it a CVSS score of 8.8, and reports a $48,000 Microsoft bug bounty. Those accounts may describe different remediation milestones; the available public reporting does not resolve the timeline more precisely. Both reports describe the specific vulnerability as fixed before the Black Hat presentation.
A compound AI-agent attack path
The technical significance is the composition of attack layers rather than prompt injection alone. The reported chain joined document-borne indirect prompt injection with privilege escalation, a cloud-session weakness, and host-level sandbox escape. Security teams assessing comparable agentic systems commonly need to test each boundary independently, including untrusted-content ingestion, tool permissions, session isolation, identity propagation, and cloud runtime hardening.
Hladik told SiliconANGLE that the underlying technique could apply beyond Copilot, while describing the demonstrated vulnerability as fixed. That distinction matters: a patched implementation flaw does not by itself establish that other assistants are vulnerable, but the research provides a concrete test case for systems that process user-supplied documents and execute tools under enterprise identities.
Key Points
- 1Rubrik's reported chain connected a poisoned document, prompt injection, cloud-session path traversal, and sandbox escape into one interactive attack path.
- 2The reported post-escape channel could operate with a victim's active Copilot identity, making permission scope central to potential exposure.
- 3Comparable AI-agent architectures commonly require testing across content ingestion, identity propagation, tool authorization, and runtime isolation boundaries.
Scoring Rationale
The research describes a high-severity, multi-stage attack pattern against enterprise AI assistants, combining indirect prompt injection with cloud runtime escape. Although the reported Microsoft flaw was patched, the findings provide a significant security test case for teams deploying agents with document access, tools, and inherited enterprise identities.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
