Microsoft patches critical Copilot flaw exposing 2FA codes

Microsoft has resolved a severe security flaw in its M365 Copilot platform that enabled attackers to extract two-factor authentication (2FA) codes and other confidential information from user emails. The vulnerability, disclosed by researchers on June 17, highlights persistent challenges in securing large language models (LLMs) against indirect prompt injection attacks.

What the vulnerability allowed

The exploit leveraged Copilot’s integration with Microsoft 365 email and productivity tools. By embedding malicious instructions in third-party content—such as emails or documents—attackers could trick the AI into processing and exfiltrating sensitive data. The researchers demonstrated that Copilot would comply with requests to retrieve 2FA codes, passwords, or other confidential information, then transmit it to an external server.

To bypass built-in guardrails preventing direct data exfiltration, the attackers used two techniques. First, they embedded instructions in markup language, which Copilot interpreted as formatting commands rather than security threats. Second, they wrapped sensitive data in HTML tags like <img> or <form>, triggering automatic web requests to attacker-controlled servers. These requests logged the stolen data, including 2FA codes, in server logs.

Why the flaw matters

The vulnerability underscores a fundamental limitation in current LLM security: the inability to reliably distinguish between legitimate user instructions and malicious content embedded in third-party data. Microsoft and other AI providers have implemented ad hoc guardrails to mitigate such risks, but these measures remain vulnerable to creative workarounds. The incident reflects broader industry concerns about the security of AI-driven productivity tools, particularly when integrated with sensitive enterprise data.

For Microsoft, the patch arrives amid growing scrutiny of its AI security practices. While the company rated the flaw as "max critical," the disclosure timeline—six days between patch release and public disclosure—aligns with industry norms for responsible vulnerability reporting. However, the incident raises questions about the long-term viability of guardrails as a primary defense mechanism.

What professionals should know

The flaw also serves as a reminder that AI tools, while powerful, introduce new attack surfaces. Enterprises should weigh the productivity benefits of AI assistants against the risks of indirect prompt injection, particularly in environments handling sensitive data like authentication codes or financial information.