Enterprise AI over-trust: Abusing M365 Copilot via Legacy Paths

We keep hearing that web security is mature and prompt injection is the new problem. Both are wrong, or at least incomplete in a way that gets people owned. During the session, we expose a new 1-click attack chain against Microsoft 365 Copilot Enterprise Search that exfiltrates sensitive data from a victim's mailbox, including MFA codes, by chaining three bugs that span three different security eras. A URL parameter gets interpreted as an executable AI prompt (Parameter-to-Prompt Injection). The AI's response streams an img tag into the DOM before the output sanitization guardrail kicks in, a race condition between rendering and the code-block wrapper. And that img tag points at Bing's Search by Image endpoint, which is CSP-allowlisted and performs a server-side fetch to our domain, leaking the exfiltrated data outside of browser CSP enforcement entirely. One click. No malware. No credential theft. The victim's own AI assistant does the work. The critical finding is that each defense was working correctly. The CSP was enforced. The guardrail fired. Input validation existed. The attack succeeded because nobody tests the composition of old web bugs with new AI behaviors. Web security teams do not look at prompt pipelines. AI red teams do not audit CSP headers. We walk through the full technical exploitation, demonstrate it live, and present a broader approach for finding these compound vulnerabilities, old web primitives meeting AI-era attack surfaces, systematically. We share detection heuristics and architectural fixes that address the root causes.