Time Table

Imagine uploading a document to an AI assistant and having your entire Microsoft 365 environment compromised. In this presentation, we reveal “Remote Prompt Execution” - an attack class where attackers execute arbitrary prompts on a victim’s session.

We walk through a full exploit chain starting with an LLM safety filter bypass to gain unprivileged execution in the sandbox. Next, we escalate privileges to root inside the container to unlock a hidden attack surface. We then exploit an unauthenticated internal daemon in the AKS Image Streaming service to achieve arbitrary file writes on the host, escaping the sandbox entirely.

Finally, we demonstrate how this grants interactive shell access over Copilot, exposing emails, calendar events, and files. We cover the discovery methodology, impact across Azure services, and MSRC disclosure.

** Important: Talk was/will be presented at Black Hat USA 2026.