Rubrik Zero Labs Unveils RPE: From Word Document to Shell on…

Remote Prompt Execution turns prompt injection into full enterprise identity compromise on Microsoft 365 Copilot. The five-stage chain exploits hidden text in a Word document to bypass LLM classifiers, escalate privileges, traverse paths in Azure Container Apps, and escape the sandbox via LD_PRELOAD — handing the attacker a live, bidirectional shell that inherits the victim's SSO identity, permissions, and cloud access.

Ori Lahav and Dan Avraham of Rubrik Zero Labs presented the "Remote Prompt Execution" (RPE) vulnerability class at Black Hat USA 2026, demonstrating how a Word document with hidden text can become a persistent, interactive shell on Microsoft 365 Copilot. The research, published August 6, 2026, does not describe just another AI bug: it redraws the security perimeter of enterprise AI integrations, shifting the target from the language model to the execution architecture that surrounds it.

Key Takeaways

Rubrik Zero Labs defined and demonstrated the "Remote Prompt Execution" (RPE) vulnerability class on Microsoft 365 Copilot at Black Hat USA 2026.
The exploit chain unfolds in five stages: from a Word document with white-on-white text to a bidirectional interactive shell via LLM classifier bypass, privilege escalation, path traversal in Azure Container Apps, and sandbox escape via LD_PRELOAD.
The underlying vulnerability is CVE-2026-32193, a path traversal (CWE-22) in Azure Kubernetes Service with CVSS 8.8, patched by Microsoft in the June 2026 security update with a $48,000 bug bounty.
The compromised session inherits the user's identity, permissions, and access to M365/Azure enterprise data: the attacker becomes the user without any further escalation.

The Mechanism: Five Stages, One Chain

The initial vector is trivial and insidious: a Word document with hidden white-on-white text, which the user uploads to Copilot for analysis or summarization. The prompt injection delivered this way bypasses the LLM classifier's guardrails, achieving code execution in the AI assistant's sandboxed environment.

From there, the chain proceeds through three subsequent phases of lateral movement and privilege escalation. The fourth stage exploits CVE-2026-32193, a path traversal vulnerability in Azure Container Apps dynamic sessions, specifically in the ACA-Session-Interpreter component. With a CVSS 8.8 score and CWE-22 classification, this flaw lets the attacker break out of the intended execution context and access the container filesystem.

The fifth and final stage uses LD_PRELOAD to force a sandbox escape and reach the underlying host. The result is a bidirectional command-and-control channel: the attacker injects prompts into the victim's live session and reads responses in real time. As forkast.news reported, citing Rubrik Zero Labs data, "the chain is the threat, not any single step" in isolation.

Identity Inheritance: Why No Further Escalation Is Needed

After the sandbox escape, the compromised Copilot session retains the legitimate user's SSO identity. Permissions, access to enterprise data in Microsoft 365 and Azure, cloud authorizations — all are inherited automatically. The attacker does not need to steal credentials, perform additional lateral movement, or escalate privileges.

The source explicitly describes this mechanism: the attacker "operates as the user" with full visibility into what the user can see and modify. This characteristic distinguishes RPE from previously documented prompt injection vulnerabilities: it is not about extracting information from the model or manipulating responses, but about turning the AI assistant into a proxy for complete identity compromise.

The "ChatMate" proof-of-concept, detailed in a July 30, 2026 technical blog by Kyle Fiehler on Rubrik Zero Labs, demonstrates the class of techniques without constituting an active in-the-wild exploit. The sources explicitly specify this limit: ChatMate is research, not a documented offensive operation.

Context: When the AI Sandbox Is No Longer Enough

Rubrik Zero Labs' research places CVE-2026-32193 in a broader frame. The arXiv EchoLeak (CVE-2025-32711, Aim Labs) had already demonstrated prompt injection vulnerabilities on Copilot, but with a different mechanism and authors: it must not be confused with RPE. ChatMate's novelty lies in proving that the surrounding execution architecture — not the language model itself — is the true breaking point.

The sources emphasize that sandboxed execution environments for AI assistants are not unique to Microsoft. The implication is that companies with similar architectures, integrating AI assistants with enterprise data in containerized cloud environments, could present analogous attack surfaces. The brief does not specify vulnerable entities beyond the demonstrated Microsoft case.

Defensive Posture: What We Know and What Is Missing

Microsoft released the patch for CVE-2026-32193 in the June 2026 security update, with a $48,000 bug bounty payment. The Editorial Dossier does not document additional specific countermeasures implemented by the vendor beyond this fix. The source does not specify whether Microsoft modified the ACA-Session-Interpreter container isolation architecture, LLM security classifiers, or Copilot session identity inheritance policies.

The following remain unverifiable from the provided sources: the NVD status of CVE-2026-32193, the exact date of presentation at Black Hat USA 2026, full technical details of the Rubrik Zero Labs blog, and independent confirmation of the LD_PRELOAD mechanism for sandbox escape. No infrastructure overlaps linking this research to other operators or offensive campaigns emerge at this time.

"A single poisoned document can hand an attacker an interactive shell inside the Copilot session — and the attacker inherits your identity, your data, your cloud access."

Why It Matters

Rubrik Zero Labs' research shifts the debate from "is the LLM secure?" to "is the execution environment around the LLM sufficiently isolated?" For enterprises that have adopted or are adopting AI assistants integrated with enterprise data, RPE demonstrates that the most trivial vector — an uploaded document — can turn into total compromise of identity and cloud access. User permission inheritance eliminates the traditional post-exploitation phase: the attacker is immediately the user, with all that entails.

The source does not specify the exact nature of exposed data beyond the generic indication of "enterprise data" in M365 and Azure. It does not document specific corrective measures for security operators beyond applying the Microsoft patch. The brief does not list indicators of compromise, detection rules, or architectural mitigation techniques for environments with similar AI integrations.

The absence of in-the-wild exploits does not reduce the relevance of the attack class: ChatMate has proven feasibility, and the target architecture is not proprietary in its general schema. The question the sources leave open — and that security newsrooms will need to track — is how quickly other researchers or operators could adapt the same chain to other enterprise AI ecosystems.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references