Hook
$48,000. That is the price Microsoft paid to buy back the ability to turn a Word document into a root shell. At Black Hat USA 2026, Rubrik Zero Labs researchers Ori Lahav and Dan Avraham demonstrated a five-stage exploit chain against Microsoft 365 Copilot. The underlying flaw is CVE-2026-32193, a CWE-22 path traversal in Azure Kubernetes Service, with a CVSS score of 8.8. Microsoft patched it in the June 2026 security update and rewarded the researchers with a $48,000 bug bounty. The specific vulnerability is closed. The technique class, Remote Prompt Execution (RPE), is not.
The demonstration starts with something mundane: a document upload. The attacker embeds hidden white-on-white text inside a Word file. The victim opens it. The LLM safety classifiers are bypassed. Privilege escalation follows inside the Copilot sandbox. The attacker then exploits a path traversal in Azure Container Apps dynamic sessions, targeting the ACA-Session-Interpreter. Finally, an LD_PRELOAD exploit escapes the container and reaches the underlying host. What remains is a bidirectional interactive channel. The attacker can inject prompts into the victim’s live assistant session and read back every response. Because that session inherits the victim’s identity, permissions, and access to enterprise data sources like M365 and Azure, the attacker does not need to steal credentials. The attacker becomes the user.
That last sentence is the whole story. A document upload becomes a shell. The shell inherits everything the user can see. This is not a chatbot telling a joke it should not tell. This is a persistent, interactive remote access tool delivered through the AI assistant’s own architecture.
Context
RPE is the bridge between prompt injection and traditional code execution. Most security teams still classify prompt injection as an LLM content problem: filter the input, sanitize the output, ask the model to be careful. That mindset is obsolete. The Rubrik Zero Labs research shows that the injection is only stage one of a five-stage chain that moves from data plane to container plane to host plane.
The architecture under attack is not unique to Microsoft. Enterprise AI assistants are built on sandboxed execution environments. When a user asks Copilot to analyze a spreadsheet or run a Python script, the request is processed inside a dynamically provisioned container. The container has access to the user’s identity, the user’s data, and the toolchain needed to get the job done. That is the design. It is also the vulnerability.
Kyle Fiehler authored the Rubrik Zero Labs technical blog, published on July 30, 2026. The post is careful to note that the ChatMate proof-of-concept demonstrates a technique class, not an active in-the-wild exploit. That distinction matters for legal disclosure, but it should not comfort security teams. In my experience, every major exploit class starts as a proof-of-concept. The exploit becomes a weapon when the operational environment is complex enough that defenders cannot see the chain as a whole.
The broader pattern has been visible all summer. CVE-2026-9198 in IBM Langflow triggered a CISA emergency deadline after unauthenticated remote code execution was found in the platform’s default configuration. CVE-2026-33017, another Langflow flaw, was exploited within 20 hours of public disclosure. CVE-2026-55255, an IDOR vulnerability in Langflow, was used to harvest LLM provider keys and cloud credentials. Unit 42 documented an autonomous attack campaign where threat actors deliberately selected DeepSeek because its safety guardrails were weakest. Agent infrastructure has become the attack surface. RPE adds a new vector to a rapidly growing list.
Core
I audit the logic, not the hope. So let me walk through the chain as a sequence of trust failures.
Stage one is document upload. The attacker crafts a Word document with white-on-white text. Human eyes see an empty paragraph. The LLM tokenizer sees instructions. The injection text is designed to bypass the safety classification guardrails that Microsoft places between user input and model response. This is not a novel trick in isolation. Prompt injection has been documented since the early days of LLM APIs. What matters here is that the injection is not the final payload. It is the key that unlocks the door.
Stage two is privilege escalation within the Copilot sandbox. The injected prompt instructs the model to perform actions that are normally restricted. The exact prompt structure has not been fully publicized, but the outcome is clear: the attacker gains a foothold inside the isolated session. The sandbox was supposed to be the boundary. It is not.
Stage three is the path traversal. CVE-2026-32193 lives in Azure Kubernetes Service, but the researchers reached it through Azure Container Apps dynamic sessions. Specifically, they targeted the ACA-Session-Interpreter. A path traversal vulnerability allows an attacker to access files outside the intended directory. In a containerized environment, the intended directory is the ephemeral workspace. The unintended directory is the host filesystem. The severity score of 8.8 reflects the fact that this is not a read-only bug. It gives the attacker a reliable foothold on the container host.
Stage four is the LD_PRELOAD exploit. LD_PRELOAD is a Unix environment variable that forces the dynamic linker to load a specified shared library before any other library. If an attacker can control LD_PRELOAD, they can intercept arbitrary function calls. This is a classic sandbox-escape technique. The dynamic linker trusts the environment. The attacker abuses that trust to load a malicious library into a privileged process. The library can then manipulate file operations, spawn processes, or disable security checks.
Stage five is the result: a bidirectional channel between the attacker and the victim’s live assistant session. The attacker can inject new prompts at any time. They can read the responses in real time. Because the session is stateful and authenticated as the victim, the attacker inherits the victim’s access to M365, Azure, email, documents, and whatever else the assistant can reach. Data exfiltration is not a separate attack. It is a feature of the compromised session.
Let me be precise about why this is dangerous beyond the individual CVE. The chain is the threat. Each stage on its own can be mitigated. A content filter might catch the white-on-white injection. A hardened container might resist the path traversal. A well-configured linker might ignore LD_PRELOAD. But the chain is not a list of independent failures. It is a pipeline. The attacker only needs every stage to succeed once. The defender needs every stage to fail forever.
In my years auditing smart contracts, I learned that a single vulnerability is rarely the whole story. The same principle applies here. The CVE-2026-32193 patch is a necessary step, but it is not a sufficient defense. The RPE class lives in the intersection between LLM safety, container isolation, and identity inheritance. Each of those domains has its own security team. Nobody owns the intersection. The attack exploits that ownership gap.
There are no guaranteed returns in security. Every patch is a delay, not a permanent stop. The team at Rubrik did the right thing: they reported the bug, Microsoft fixed it, and the public got a detailed technical writeup. But the technique class will resurface in other products. Any AI chat interface that relies on containerized execution models is a potential RPE target. The vendors change. The architecture does not.
Contrarian
The obvious takeaway from this research is “patch Azure Kubernetes Service.” That is not wrong, but it is dangerously incomplete. Patching CVE-2026-32193 closes one instance of the RPE class, not the class itself. The white-on-white text is a delivery mechanism. The path traversal is a convenient ladder. The real weakness is the assumption that prompt injection is a content problem instead of a control-flow problem.
When a user uploads a document, the LLM processes that document as data. But the output of that processing is used to drive actions. The boundary between data and instruction is inside the same process. The LLM cannot reliably tell the difference between “this document contains a fact about the world” and “this document contains a command for you to execute.” Every safety classifier is a heuristic. Heuristics fail. The Rubrik research proves that the failure can be weaponized with surgical precision.
The second blind spot is the commercial push toward autonomous agents. The more autonomy an agent has, the more powerful an injected prompt becomes. A chatbot that can only read text is a nuisance. An agent that can call APIs, access mailboxes, and execute code is a remote control for the enterprise. The market is selling these systems as productivity tools. From a security perspective, they are remote administration tools with a natural-language API. RPE exposes that uncomfortable truth.
The third blind spot is the assumption that attackers will always target the most publicized platform. Unit 42’s report on DeepSeek shows the opposite. Threat actors are selecting models with weak guardrails specifically because those guardrails are easier to bypass. If an enterprise deploys a cheaper AI assistant with a less mature container isolation model, it becomes a more attractive target. The security posture of the underlying infrastructure matters more than the brand name of the LLM.
I have seen this movie before. In 2022, I audited a yield aggregator whose “emergency pause” function was protected by a multi-sig wallet that had not signed a transaction in months. The smart contract code was correct. The operational layer was broken. The audit badge was meaningless. The same logic applies to AI security. A patch for CVE-2026-32193 is a badge. The operational reality is that every document upload is now a potential code execution primitive.
Code doesn’t care what you intended. It executes what you wrote. The attacker writes the document. The victim opens it. The LLM executes the hidden instructions. The container escapes. The session becomes a conduit. Every step is mechanical. There is no malice in the machine, only decisions made by trust boundaries that were never designed to hold.
In my own trading systems, I have learned that arbitrage is just patience wearing a speed suit. Exploit chains are the same. The attacker is patient. They wait for the document to be opened. They wait for the container to spin up. They wait for the right moment to escape. This is not a race. It is a sequence of dependent conditions. Security teams need to break the sequence at multiple points, not just at the one CVE that made the headlines.
What would that look like in practice? First, treat every uploaded document as untrusted data and untrusted instructions. Do not let the LLM act on instructions hidden inside files without explicit user confirmation. Second, isolate the agent runtime from the identity layer. The assistant should not inherit the user’s full credentials by default. It should receive a scoped, expiring token with a minimal permission set. Third, monitor container escape indicators: unexpected LD_PRELOAD variables, path traversal attempts, or sessions that suddenly begin accessing files outside their workspace. Those events should trigger an immediate kill-switch.
The Rubrik research is a useful reminder that security teams must validate the entire stack, not just the top layer. The LLM is the user interface. The container is the execution floor. The identity layer is the crown jewels. RPE hits all three in sequence.
Takeaway
The specific vulnerability, CVE-2026-32193, is patched. The broader RPE class is not. Security teams protecting AI-integrated environments now have to accept a new axiom: a document upload can become a shell, and that shell inherits everything the user can see. The next vendor announcement will not say “we have solved RPE.” It will say “we have patched another instance of it.”
Trust the stack, verify the exit. Speed is the only shield in a flash loan, but in an RPE attack, speed belongs to the attacker. The defense is not faster. It is deeper. Build the trust boundaries as if the LLM is already compromised. It probably is.