ChatMate: The First Documented Escape from the Microsoft Copilot Sandbox

Researcher Ori Lahav detailed the technical steps on LinkedIn: "The exploit chain involved: 🔓 Prompt Injection 🔓 Privilege Escalation 🔓 Path Traversal 🔓 .toml Injection 🔓 and finally an LD_PRELOAD Exploit" .

Vulnerability Designation, CVSS Score, and Bounty

• CVE-2026-32193 — the underlying Azure Kubernetes Service path traversal issue that enabled the sandbox escape .
• CVSS score of 8.8 (High severity) .
• Bug bounty: $48,000 from Microsoft . Researcher Ori Lahav confirmed this amount publicly on LinkedIn .

Microsoft patched the flaw by mid-March 2026 after Rubrik's responsible disclosure in February . Notably, Microsoft 365 Copilot customers did not need to deploy a new patch themselves since the fix was server-side .

Broader AI Security Incidents at Black Hat USA 2026

The ChatMate disclosure was part of a wave of related AI security findings at the same conference:

• Zenity Labs — "PleaseFix" zero-click chains: Demonstrated exploit chains across Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge. These enabled silent data theft, credential theft, account takeover, and remote device control .
• Zenity Labs — "AgentForger" (ChatGPT): A critical vulnerability where a single malicious link could hijack OpenAI's ChatGPT Agent Builder to forge an attacker-controlled AI agent inside a victim's account with that employee's own credentials and connected apps .
• Trojanized AI skills supply-chain attack: Zenity Labs uncovered a credential-stealing campaign on Vercel's skills.sh registry where typosquatted AI agent skills racked up over 1.7 million installs to deploy credential stealers .
• Exposed AI backends weaponized: Zenity Labs' honeypots caught attackers hijacking exposed Ollama and LiteLLM instances to run autonomous pentesting tools against third parties .

What This Means for Enterprise AI Assistant Adoption

• Sandbox escape is now a demonstrated reality, not a theoretical risk. Any enterprise deploying AI assistants with document-processing capabilities inherits this attack surface .
• A single document upload is a viable initial access vector — no phishing clicks, no macros, no additional user interaction required . Traditional email and file security controls need to treat AI-processed content as an execution channel.
• The "Remote Prompt Execution" class shows that prompt injection is not just a data-leakage concern; it can escalate to full host compromise via chained exploits . Security teams must think in terms of "agentic resilience" — including the ability to detect and roll back destructive AI agent actions — rather than prevention alone .
• The AI software supply chain is under active attack — the 1.7M-install credential-stealing campaign and typosquatted skills demonstrate that agent skill registries are the new app stores, with similar trust and verification challenges .
• Rubrik Zero Labs found that only 23% of organizations have full visibility into their AI agents, making detection of this kind of compromise extremely difficult today .