- Ori Lahav said a simple cover story got past Copilot's safety filter, and the later steps of his attack used flaws in a cloud service.
- He urged limiting pods' network access to the host, and assuming attackers can reach internal services, so those services need high standards too.
Ori Lahav, a security researcher at Rubrik Zero Labs, showed how an attacker could take over a user's Copilot chat session. He spoke at Black Hat USA 2026, in a talk released on the Black Hat channel on 13 November. The attack started when a victim uploaded a booby-trapped document to Copilot. The AI safety filter fell to a simple cover story. The later steps relied on flaws in the cloud service behind Copilot's sandbox.
What was said
Lahav's team wanted Copilot to run attack code in its sandbox, the locked-down space where it runs Python. Copilot rejected suspicious commands, even when they were compressed. So the team told it a story: the compressed file was a benchmark of the Gzip tool. Lahav said: "All we have to do is to tell the LLM some stories."
The later weak points, he said, were in the infrastructure. A startup script ran as root, yet code inside the sandbox could write to it. That gave the team root rights inside the sandbox. Sniffing traffic revealed the backend, Azure Dynamic Sessions. From a container app he created, they guessed web routes until one let them write configuration files. The service did not clean up new lines in names. A symbolic link, which is a file shortcut, then let them overwrite a file of their choice on the host machine. That took them out of the sandbox.
The demonstrated outcome was a hijacked chat. Lahav said "the attacker can now send arbitrary prompts to the victim's copilot, which allows the attacker to get an interactive access to the victim's assistant."
Why it matters
Our reading: a safety filter is one layer, and a persuasive story can get past it. What sits behind the filter then carries the weight. Buyers and builders of AI assistants should ask what happens once the filter fails. Can code in the sandbox edit a script that runs as root? Can any workload reach internal services?
Lahav's own advice was to limit pods' network access to the host and to assume attackers can reach internal services. He also asked for high standards from those services. Because Copilot uses an off-the-shelf Azure product, he said, the flaw is relevant to that product and not only to Copilot. Who bears the cost when a shared layer fails is a question customers can put to their vendors. The talk did not answer it.
The other side
Lahav called prompt injection, where hidden text in an input steers the model, a big issue. He asked for extensive monitoring of sessions that take untrusted input. The attack also needed a victim to upload the document, so the AI weakness was part of the chain.
The excerpts do not show how the sandbox escape connects to the takeover of the chat session. They do not show how common such flaws are, or whether this one was fixed. They say only that Microsoft assigned a CVE and a bug bounty after he reported it.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- Black Hat: Black Hat USA 2026 | ChatMate: Remote Prompt Execution on AI Assistants through Sandbox Escaping (2026-11-13)
