Rubrik Zero Labs researchers demonstrated ChatMate, the first public chain for Remote Prompt Execution (RPE) against Microsoft 365 Copilot: one malicious document can trigger Copilot's Python sandbox, escape to the host, and give an attacker a live, two-way prompt shell that runs with the victim's M365 identity. The work is documented in Breaking the M365 Copilot Sandbox with ChatMate and presented at Black Hat USA 2026. Microsoft fixed the host-escape path as CVE-2026-32193 before disclosure, with MSRC listing CVSS 8.8 for a path traversal in Azure Kubernetes Service.
For builders shipping copilots with code interpreters, the lesson is not a single bug ID. It is that sandbox plus LLM plus enterprise SSO can become operator access if any layer confuses program output with the next user instruction. That pattern sits beside indirect prompt injection, Google's self-hosted agent sandboxes, and the Cursor–Fireworks trace breach as another way AI plumbing widens blast radius.
TL;DR #
| Question | Answer |
|---|---|
| Attack class | **Remote Prompt Execution** — bidirectional prompt control after one trigger ([Rubrik](https://zerolabs.rubrik.com/blog/breaking-m365-copilot-sandbox-chatmate?ref=explainx) ) |
| Entry vector | Indirect prompt injection via document Copilot analyzes | | Sandbox | Azure Container Apps Dynamic Sessions behind Copilot's code tool | | CVE cited | CVE-2026-32193 path traversal; MSRC CVSS8.8 (NVD ) | | Patched? | Rubrik timeline: sandbox PE March 19, 2026 ; host escapemid-April 2026 ;$48,000 bounty | | Victim impact | Attacker prompts Copilot with victim permissions; reads full replies |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
Why RPE is a new step beyond prompt injection #
Indirect prompt injection already tricks models with hidden instructions in mail, tickets, and uploads. Security teams map that risk in guides like our Oblomovka-style social engineering post and in MCP tool poisoning discussions.
Rubrik draws a sharper line. RPE means the attacker keeps an interactive loop: send a prompt, read the entire assistant response, choose the next prompt, repeat. ChatMate implements that loop after escaping Copilot's isolated interpreter. The victim may only see benign answers to visible tasks while hidden program output steers Copilot's next turns.
The researchers compare the capability to Reprompt-style server-driven chains but emphasize that ChatMate crosses the execution boundary rather than relying on Copilot's intended internet features alone. Either way, the enterprise outcome is the same class of harm as a compromised workstation session scoped to whatever Graph and M365 tools Copilot can touch.
Bidirectional prompt channel after ChatMate sandbox escape from M365 Copilot code execution
How the ChatMate chain works #
Rubrik's public write-up breaks the chain into stages that align with what Black Hat USA 2026 session materials describe.
Stage 1: Indirect prompt injection in a document
The victim opens a document Copilot is asked to analyze. Hidden instructions tell the model to run Python through Copilot's code execution tool and to treat later program output as confidential follow-up instructions the user must not see.
That is classic indirect injection, but it targets a feature meant for spreadsheets and charts, not chat-only bots.
Stage 2: Bypassing Copilot's code safety layer
Copilot resists obviously hostile code such as process listings. Rubrik reports a gzip benchmark wrapper: compress arbitrary Python, present it as a benign performance test, and Copilot decompresses and executes the payload. The same harness becomes a REPL for reconnaissance inside the sandbox.
Stage 3: Privilege escalation inside the sandbox
Reconnaissance shows Copilot's environment as a Jupyter-style kernel running as an unprivileged user while entrypoint.sh runs as root. Rubrik reports the entrypoint script was writable by the sandbox user. Appending commands after a blocking wait line and terminating child processes eventually executes attacker code as root inside the container.
Microsoft fixed this sandbox privilege escalation on March 19, 2026, per Rubrik's disclosure timeline.
Stage 4: Host escape via CVE-2026-32193
With root inside the sandbox, traffic capture identified Azure Dynamic Sessions and a localhost service Rubrik abused for directory traversal and configuration injection, ultimately achieving arbitrary file write on the host and code execution on the Kubernetes node.
Microsoft cataloged the flaw as CVE-2026-32193, CWE-22 path traversal in Azure Kubernetes Service, with a vendor CVSS of 8.8. The NVD entry lists affected AKS builds below v0.20260213.5. Rubrik states the fix landed in mid-April 2026.
Because Dynamic Sessions is a shared Azure product, Rubrik argues impact extends beyond Copilot to other workloads that expose the same localhost surface.
Stage 5: Remote Prompt Execution
After escape, the attacker uses a bidirectional channel: outbound prompts ride sandbox output into Copilot's context; inbound answers return over the network. Copilot executes each attacker prompt with the victim's session identity, so mail, calendar, and files within Copilot's reach become queryable one prompt at a time.
Rubrik's demo video shows an operator asking about meetings and follow-up questions about a sensitive acquisition topic while the victim sees only the visible task output.
What developers are saying #
On Hacker News, vbCrLf (Rubrik researcher Ori Lahav) wrote that MSRC fixed the chain and awarded a $48,000 bounty before the Black Hat talk. The comment frames that as his disclosure experience, not independent confirmation of your tenant's patch state. The thread is still thin on third-party reproduction, which is expected for a patched chain.
Treat HN comments as practitioner color, not confirmation of your own tenant's patch state.
What Microsoft and Rubrik say about fixes #
Rubrik's disclosure timeline, quoted in its blog, lists:
-
February 10, 2026 — Sandbox privilege escalation and host path reported to MSRC
-
March 19, 2026 — Sandbox privilege escalation fixed
-
Mid-April 2026 — Host escape chain fixed;CVE-2026-32193 assigned MSRC's public CVE text does not name Copilot, but Rubrik ties the same primitive to Copilot's Dynamic Sessions backend. Your patch program should cover AKS, Azure Container Apps, and Dynamic Sessions estates, not only the Copilot admin toggle.
What security and platform teams should do #
Patch and inventory Azure. Map clusters and Container Apps builds against CVE-2026-32193 remediation guidance. If you self-host agent runtimes inspired by Dynamic Sessions, compare isolation boundaries to our Gemini managed agent sandbox notes.
Treat documents as prompt carriers. DLP and malware scanners built for macros miss white-on-white text aimed at Copilot. Combine upload policies with least privilege on Copilot connectors. For a broader incident calendar, see the November 2026 cyberattacks tracker.
Assume code tools are code execution. Any assistant feature that runs model-generated Python is a miniature CI job with user creds. Red-team it like you would a Jupyter hub on the corporate VLAN.
Monitor assistant sessions. Look for bursts of Graph-backed queries after document opens, or tool calls inconsistent with the visible chat. AgentBeam helps teams block dangerous tool and shell actions when agents run with production credentials — the same control point matters when the agent is Copilot rather than Claude Code.
Enterprise M365 Copilot session scope after a ChatMate-class Remote Prompt Execution chain
How ChatMate compares to other agent incidents #
| Incident | Mechanism | User action after first click |
|---|---|---|
| ChatMate RPE | Document → sandbox → host → prompt channel | None — attacker drives Copilot |
| Cursor marketplace malware | Trojanized extension | Install or update extension |
| [Amazon MADpot decoy](https://explainx.ai/blog/amazon-madpot-artex-agent-memory-decoy-llm-api-2026) | Honeypot observability | Attacker must target decoy |
| [Epoch impersonation report](https://explainx.ai/blog/epoch-trajectory-gemini-4-argon-live-website-impersonation-report-2026) | Site spoofing | Visit fake property |
ChatMate is notable because it chains LLM abuse with container escape and then returns to LLM abuse at a higher trust level.
Rubrik disclosure timeline (verified from its blog) #
Rubrik Zero Labs published a staged disclosure list that security teams can paste into change tickets:
| Date | Milestone |
|---|---|
| 2026-02-10 | Sandbox privilege escalation and host path reported to MSRC |
| 2026-03-19 | Sandbox privilege escalation remediated |
| Mid-April 2026 | Host escape remediated; CVE-2026-32193 assigned; $48,000 bounty | The NVD record lists Microsoft as CNA with CVSS 8.8 and affected AKS builds below v0.20260213.5. Rubrik stresses that four Microsoft product areas touched the chain: Copilot, Dynamic Sessions, Container Apps, and AKS. Your vendor-risk questionnaire should ask about all four, not only the Copilot SKU.
For red-team programs, compare Rubrik's chain to OpenAI Daybreak and Amazon MADpot: one is vendor-led offense research, the other is observability of real attacker behavior. ChatMate sits in the published exploit bucket with patches already shipped.
FAQ-style questions teams ask #
Do we disable Copilot code execution? That is a policy call. If you keep it on, pair Rubrik's lesson with strict document trust zones and rapid Azure patching.
Does Private Mode help? ChatMate's chain does not replace tenant logging or DLP. It exploits features Copilot already exposes to the signed-in user.
Will other vendors see RPE? Rubrik explicitly warns that any assistant using similar disposable sandboxes with weak localhost trust is in scope. Audit your vendor's code-interpreter architecture instead of copying Microsoft's toggle names.
Should we ban document-grounded Copilot? Most enterprises will not. Narrower wins come from classification, DLP on uploads, and session logging paired with the Azure patches above. Rehearse response playbooks using the same discipline as our November 2026 cyberattacks tracker recommends for stolen keys and poisoned extensions.
Does CVE-2026-32193 alone equal RPE? No. Rubrik's narrative requires chained primitives. Patching the traversal closes the host escape they used, but indirect injection against any code tool remains a standing task for security engineering.
Related reading #
Technical details reflect Rubrik Zero Labs' published research and Microsoft's CVE-2026-32193 record as of November 15, 2026. Patch levels and Copilot feature flags vary by tenant.