The tl;dr:
-
Prompt inject a malicious instruction in a word document that instructs the AI to copy this instruction to other documents as part of the payload.
-
Dumb user downloads and opens the document with copilot enabled, abd ignores the large suspicious white blank page that totally doesnt look like a hidden giant injection attack.
-
Thats it pretty much it.
Copilot will get injection attacked because the prompt is super huge and at the end of the document, so its prior instructions start to fuzzy out.
Then it'll go "okey doke" and start copying the prompt injection attack payload to a bunch of other documents.
The fix is stupid simple... copilot should just be prompting the user for permission if it ever edits a file other than the one that is open. Im surprised that isnt already the case...?
It certainly is already the case for copilot in vscode.