Copirate 365. The access path.
A CSS font-face rule carried data out of Microsoft 365 Copilot after image sanitising. Blocking one rendering primitive moves the channel. It does not close it.
The record
Entry point. document in Microsoft 365, hidden instructions in a file Copilot processes during normal use.
The identity in the middle. None stolen. Copilot's automatic tool use over the user's own Microsoft 365 content, under their delegated access.
What was reached. attacker server, the data leaves repeatedly, as a styling request rather than an image.
A CSS font-face rule carried data out of Microsoft 365 Copilot after image sanitising.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| document in Microsoft 365 | Entry | hidden instructions in a file Copilot processes during normal use |
| automatic tool invocation | Step | Copilot retrieves the user's private data as instructed |
| HTML preview rendering | Step | a CSS font-face declaration is used where image tags were already sanitised |
| attacker server | Reached | the data leaves repeatedly, as a styling request rather than an image |
Where a breakpoint would have been
The combination, not the primitive. Private data access, untrusted content and an outbound request in one session is the condition; images and fonts are interchangeable symptoms. Removing one of the three is the only change that does not get worked around.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
4 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Johann Rehberger, Embrace The Red · MITRE CVE record, CVE-2026-24299
Questions, answered.
The two questions this record answers.
What was the entry point in the Copirate 365 incident?
The published path starts at document in Microsoft 365, hidden instructions in a file Copilot processes during normal use.
What did it reach?
The last step in the published path is attacker server, the data leaves repeatedly, as a styling request rather than an image.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.