posted in Technology
Microsoft confirms an AI worm is propagating through Copilot and other MS apps | CSO Online
www.csoonline.com/article/4203630/microsoft-confirms-an-ai-worm-is-propagating-through-copilot-and-other-ms-apps.html
CSO OnlineMicrosoft confirms an AI worm is propagating through Copilot and other MS appsAlthough there are a few ways to mitigate the risk, the only way to block it is to get AI to differentiate instructions from data, which is impossible today.Replying to @FoxtrotDeltaTango@sh.itjust.works
The tl;dr:
Prompt inject a malicious instruction in a word document that instructs the AI to copy this instruction to other documents as part of the payload.
Dumb user downloads and opens the document with copilot enabled, abd ignores the large suspicious white blank page that totally doesnt look like a hidden giant injection attack.
Thats it pretty much it.
Copilot will get injection attacked because the prompt is super huge and at the end of the document, so its prior instructions start to fuzzy out.
Then it’ll go “okey doke” and start copying the prompt injection attack payload to a bunch of other documents.
The fix is stupid simple… copilot should just be prompting the user for permission if it ever edits a file other than the one that is open. Im surprised that isnt already the case…?
It certainly is already the case for copilot in vscode.
Replying to @pixxelkick@lemmy.world
Considering people’s Word formatting skills, a random blank page is not suspicious
Replying to @nailbar@sopuli.xyz
The large section is also just a low effort version. I’m sure this could have been inserted instead as a collapsed section, a comment, document metadata, .1 sized font, Alt text on a single pixel image, or any number of other ways to disguise the prompt.
It’s an arms race for defenders, and even someone paying attention might not notice. Not to mention, you don’t even have to open the document. If it’s in a SharePoint library, or attached to an email, there’s a good chance it’s in scope for whatever random ‘assistance’ copilot will attempt automatically
Replying to @nailbar@sopuli.xyz
Word’s interface doesn’t help. Default view gives you almost zero information on section breaks, and even if you turn on formatting marks they behave in an unintuitive manner and there’s some edge cases where Word will still generate a new page after a continuous section break unless you set the font size after the break to 1.