Nah, not surprised at all, I work with developers who run stuff in yolo mode raw dogging copilot directly on their work laptops every day.

Madness.

I keep that stuff boxed up inside of a docker container, sandbox’d, so possible vectors of damage are kept to a minimum.

The tl;dr:

1. Prompt inject a malicious instruction in a word document that instructs the AI to copy this instruction to other documents as part of the payload.

2. Dumb user downloads and opens the document with copilot enabled, abd ignores the large suspicious white blank page that totally doesnt look like a hidden giant injection attack.

3. Thats it pretty much it.

Copilot will get injection attacked because the prompt is super huge and at the end of the document, so its prior instructions start to fuzzy out.

Then it’ll go “okey doke” and start copying the prompt injection attack payload to a bunch of other documents.

The fix is stupid simple… copilot should just be prompting the user for permission if it ever edits a file other than the one that is open. Im surprised that isnt already the case…?

It certainly is already the case for copilot in vscode.