AI sandbox escape uncovered in Microsoft Copilot flaw | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Security researchers have spent the past year watching AI accelerate attacks that already exist. A harder question is whether AI can create attack techniques that didn’t exist before. An AI sandbox escape — where an attacker breaks out of the isolated environment meant to contain an AI assistant — is one of the clearest signs yet that it can.

Joe Hladik (pictured), head of Zero Labs, the threat research arm of Rubrik Inc., the data security firm, built his team’s research practice around backup data — a source few others study. This year that focus turned to how employees use AI day to day, starting with the Copilot assistant used by roughly 20 million people and about 90% of the Fortune 500.

“No one’s looking at backup data,” Hladik said. “We found it to be a viable place to find actual intelligence to act upon.”

Hladik spoke with Krista Case at Black Hat USA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed the AI sandbox escape Rubrik Zero Labs found in Microsoft Copilot and what it means for defending AI agents. (* Disclosure below.)

Inside the AI sandbox escape that hit Microsoft Copilot

The discovery happened in February, Hladik said, and Rubrik Zero Labs followed responsible disclosure, engaging Microsoft before going public; Microsoft patched the flaw by mid-March. The specific vulnerability is fixed, though the underlying technique — breaking out of Copilot’s sandbox to reach Azure’s backend — could apply to other AI copilots, Hladik said. Researcher Ori Lahav presents the full findings at Black Hat this week.

“[That] would allow you to get command and control of probably hundreds, thousands, or much more, depending on the volume of what exists within that tenant of users’ files, SharePoint files, OneDrive, whatever,” Hladik said. “It’s a major, major find.”

That visibility gap extends beyond this one flaw. Rubrik Zero Labs’ own research found only 23% of security leaders have full visibility into the AI agents already running in their environment, a gap Rubrik is racing to close with new AI agent governance tools unveiled this week.

“Agents are just bots with models,” Hladik said. “They’re a bot that asks a model, and then the model will tell them what to do, and then they act. It’s new, it’s cool, but at the same time, I’ve seen this before.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: Rubrik sponsored this segment of theCUBE. Neither Rubrik nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE