Microsoft Copilot reveals secret input that allowed it to be hacked
摘要
研究人员通过向微软Copilot提问，而非传统逆向工程，发现其存在可被利用的严重漏洞。该漏洞允许攻击者在用户仅点击链接时窃取数据。Copilot在回答中逐步透露了其安全机制细节，最终泄露了一个未公开的提示参数，该参数可完全绕过用户确认要求。这一发现过程表明，AI助手可能无意中泄露自身安全设计的关键信息。
It’s not every day that attackers can force a frontier AI model to cough up user passwords and other sensitive data without user confirmation. That’s exactly what researchers recently did to Microsoft 365 Copilot Enterprise. Even more unusual is the source they tapped to discover the critical vulnerability that made their exploit possible. Rather than employing reverse engineering or other traditional vulnerability-hunting methods, they asked Copilot. The LLM assistant readily complied.
Researchers at security firm Varonis knew they wanted to create an exploit that would exfiltrate user data when a user did nothing more than click on a link. Like most AI assistants today, Copilot steadfastly refused and made clear that sensitive prompts like that require explicit user consent in the form of a gesture, such as pressing a return key or other key. In response, the researchers peppered Copilot with questions about the guardrails that required user confirmation before the assistant can execute powerful commands.
Loose lips sink ships
The dialog was like a game of 20 questions. Each answer provided a new clue that divulged information about the complex safety mechanism. Why was auto-execution impossible, they asked. What URL structures and deep links were involved? What happens when a page is loaded with input already in the prompt field? Each answer provided a deeper view into the guardrail and its limits. Eventually, Copilot provided a stunning Microsoft trade secret—an undocumented prompt parameter that completely bypassed the requirement for user consent.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧