2024-07 · 2024-Q3
Microsoft 365 Copilot ASCII Smuggling
Who actually said "do this"?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Microsoft 365 Copilot
Impact
Invisible Unicode characters in hyperlinks exfiltrate emails, MFA codes, and sensitive data
Root cause
Copilot rendered invisible Unicode characters carrying hidden data payloads in links
Sources
Catalog
Cite this: AgentProv incident record: Microsoft 365 Copilot ASCII Smuggling (2024-07). https://agentprov.com/incidents/2024-07-microsoft-365-copilot-ascii-smuggling
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction