--- title: Microsoft Fixes ASCII Smuggling Flaw in Microsoft 365... description: Critical vulnerabilities in Microsoft's Copilot services, including a Server-Side Request Forgery (SSRF) issue and an ASCII smuggling flaw, posed significant... canonical: https://daily.dev/posts/microsoft-fixes-ascii-smuggling-flaw-in-microsoft-365-copilot-enabling-data-theft-j1lqwo2yu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft Fixes ASCII Smuggling Flaw in Microsoft 365 Copilot Enabling Data Theft | daily.dev og:description: Critical vulnerabilities in Microsoft's Copilot services, including a Server-Side Request Forgery (SSRF) issue and an ASCII smuggling flaw, posed significant... og:url: https://daily.dev/posts/microsoft-fixes-ascii-smuggling-flaw-in-microsoft-365-copilot-enabling-data-theft-j1lqwo2yu og:image: https://api.daily.dev/og/posts/J1LQwo2Yu.png og:image:alt: Microsoft Fixes ASCII Smuggling Flaw in Microsoft 365 Copilot Enabling Data Theft og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Fixes ASCII Smuggling Flaw in Microsoft 365 Copilot Enabling Data Theft **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Critical vulnerabilities in Microsoft's Copilot services, including a Server-Side Request Forgery (SSRF) issue and an ASCII smuggling flaw, posed significant risks to user data. These were promptly patched by Microsoft. The incidents highlight the importance of robust security measures and continuous monitoring in AI-powered applications to protect against exploitation techniques like prompt injection and data exfiltration. ## Content # Critical Vulnerabilities in Microsoft Copilot Expose Sensitive Data ## Introduction Several critical vulnerabilities have been discovered in Microsoft's Copilot services, posing significant risks to user data. Two primary issues, one involving Server-Side Request Forgery (SSRF) and another concerning ASCII smuggling, were identified and patched by Microsoft. These vulnerabilities highlight the importance of robust security measures in AI-powered tools. ## SSRF Vulnerability in Microsoft Copilot Studio Researchers from Tenable uncovered a critical SSRF vulnerability in Microsoft Copilot Studio. By manipulating HTTP request prompts, attackers could bypass existing protections and access sensitive internal data. This flaw, which received a CVSS score of 8.5, allowed unauthorized read/write access to an internal Cosmos DB instance. After the vulnerability was reported, Microsoft acted swiftly to patch the issue. The company confirmed that full mitigation was achieved without requiring any action from users. ## ASCII Smuggling Flaw in Microsoft 365 Copilot Another significant vulnerability was found in Microsoft 365 Copilot, known as ASCII smuggling. In this exploitation method, attackers embedded invisible characters within hyperlinks, facilitating the exfiltration of sensitive data such as user emails and personal information. The attack vector included prompt injection and the use of AI to deceive users into revealing their data. Upon responsible disclosure, Microsoft addressed this security flaw. The patch reinforced the importance of continuous monitoring and enhancement of security protocols in AI-driven applications. ## Conclusion While Microsoft has successfully mitigated these vulnerabilities, the incidents underscore the ongoing risks associated with AI tools. Ensuring robust security measures and awareness of potential exploitation techniques like prompt injection and ASCII smuggling remains vital. Continued vigilance and proactive measures are essential to protect sensitive data in an increasingly interconnected digital landscape. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#ai](https://daily.dev/tags/ai), [#data-privacy](https://daily.dev/tags/data-privacy), [#microsoft](https://daily.dev/tags/microsoft), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/microsoft-fixes-ascii-smuggling-flaw-in-microsoft-365-copilot-enabling-data-theft-j1lqwo2yu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft Fixes ASCII Smuggling Flaw in Microsoft 365 Copilot Enabling Data Theft","url":"https://daily.dev/posts/microsoft-fixes-ascii-smuggling-flaw-in-microsoft-365-copilot-enabling-data-theft-j1lqwo2yu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-fixes-ascii-smuggling-flaw-in-microsoft-365-copilot-enabling-data-theft-j1lqwo2yu"},"datePublished":"2024-08-27T06:21:00.522Z","dateModified":"2025-07-28T02:15:24.607Z","description":"Critical vulnerabilities in Microsoft's Copilot services, including a Server-Side Request Forgery (SSRF) issue and an ASCII smuggling flaw, posed significant...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e0f8cdb8c6f81d7eee10294441c7b276?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e0f8cdb8c6f81d7eee10294441c7b276?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-fixes-ascii-smuggling-flaw-in-microsoft-365-copilot-enabling-data-theft-j1lqwo2yu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai,data-privacy,microsoft,prompt-injection,security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Microsoft Fixes ASCII Smuggling Flaw in Microsoft 365 Copilot Enabling Data Theft"}]} ```