ChatMate: first remote prompt execution lands a live shell inside Microsoft Copilot
Rubrik Zero Labs documents ChatMate, the first publicly known remote prompt execution attack: one malicious document makes Copilot run code, escape its network-isolated sandbox, and open an interactive prompt shell to the attacker. The chain starts with CVE-2026-32193, root access on an AKS node, and ends with an attacker reading M365 data one prompt at a time. Copilot packs a Python interpreter that executes model-generated code across a huge share of enterprises. That interpreter is now a proven beachhead.