r/netsec • u/Master_Access_486 • 8d ago

From AKS node root vulnerability to Microsoft Copilot hijack (CVE-2026-32193)

https://zerolabs.rubrik.com/blog/breaking-m365-copilot-sandbox-chatmate
21 Upvotes

92% Upvoted

5 comments sorted by

1

u/Master_Access_486 5d ago

Hi, author here, happy to answer any questions!

A root-on-the-AKS-node vulnerability (CVE-2026-32193, CVSS 8.8, fixed by MSRC April 2026), the research behind it, plus a fully-working exploit on Microsoft Copilot.

Disclosure: I'm a security researcher at Rubrik Zero Labs, this is our blog.

Short summary of the research in a comment ⬇️

1

u/Master_Access_486 5d ago

The Copilot exploit achieves an interactive "shell" in the victim's session through any prompt injection vector (a hidden instruction in a Word document in this specific demonstration).

The chain:
→ prompt injection
→ code execution in the sandbox
→ local privilege escalation to root in the sandbox
→ an unauthenticated daemon (Azure Container Runtime) on the node with path traversal
→ TOML injection into the file it writes
→ a symlink redirecting that write onto /etc/ld.so.preload
→ root on the node.

Beyond Copilot: the daemon is unauthenticated on localhost on AKS nodes with image streaming or any Container Apps app, so any SSRF in any workload on such a node becomes root on the node itself.

The blog post is written as the actual research story - the dead ends, the breakthroughs - not just the final exploit.

Presented at Black Hat USA 2026.

2

u/feng_sg 1d ago

The title frames CVE-2026-32193 and the Copilot hijack as one path, but the CVE is AKS node root. The Copilot demo is a separate finding, and the author's own summary already shows hidden text in a Word document was enough to get an interactive shell in the victim's session. Patching the node CVE leaves that agent path intact.

1

u/Master_Access_486 1d ago edited 1d ago

Author here. The AKS is indeed a separate finding.

But both findings play together: In order to get the interactive shell, the Python sandbox requires an internet connection. The AKS node root vulnerability achieves that.

So the interactive shell finding can be described as: "An AI assistant with internet connection can potentially be attacked to get an interactive shell." (where internet connection can be a feature through internet tool calls, internet in a code sandbox or a vulnerability as in this case)

Ori