This is my Black Hat USA 2026 talk on my research journey, ending up with CVE-2026-32193, fixed by MSRC, and awarded bug bounty $48,000.
It features an exploit chain:
→ indirect prompt injection
→ code exec in Copilot's sandbox
→ local privesc in the sandbox
→ arbitrary file write in Azure internal service
→ TOML injection + /etc/ld.so.preload
→ sandbox escape
Exploited into a full interactive access to Microsoft's AI assistant.
Beyond Copilot: the daemon is unauthenticated on localhost on AKS and Container Apps nodes with image streaming, so any SSRF in any workload on such a node becomes root on the node itself.
Author here.
Happy to answer any question :)
This is my Black Hat USA 2026 talk on my research journey, ending up with CVE-2026-32193, fixed by MSRC, and awarded bug bounty $48,000.
It features an exploit chain:
→ indirect prompt injection → code exec in Copilot's sandbox → local privesc in the sandbox → arbitrary file write in Azure internal service → TOML injection + /etc/ld.so.preload → sandbox escape
Exploited into a full interactive access to Microsoft's AI assistant.
Beyond Copilot: the daemon is unauthenticated on localhost on AKS and Container Apps nodes with image streaming, so any SSRF in any workload on such a node becomes root on the node itself.
Ori