Data Tomb Raider - Raiding Modern AI Vaults with Legacy Flaws for Treasure Stealing

The talk starts from the premise that AI assistants now read mailboxes, chats, and company files, so each new feature gives attackers another path in. The presenters describe parameter-to-prompt injection, where a URL parameter on a legitimate assistant page runs as a prompt as soon as a victim clicks the link. They use Microsoft Copilot Personal as the first case and walk through four stages: getting in, collecting data, moving it out, and getting past guardrails. A repeated-request trick got around the filter in their example.

The middle section covers Atlassian's Rovo, where the same entry point led to Confluence, Jira, and Bitbucket content through a research sub-agent that could reach the web. A later case against Microsoft 365 Copilot Enterprise had no direct internet access. The attack relied on HTML injection that rendered while the model was still streaming output, before the sanitizer ran, plus an image request routed through a Bing endpoint allowed by the content security policy. The demos show stolen data reaching an attacker server. The presenters say the vendors fixed the issues after disclosure.

To close, the speakers propose a three-step model for agent attacks: enter, evade, and escape. Teams can use it to map input channels, guardrail bypasses, and exfiltration paths. The main takeaway is to test the seams between old web defenses and new AI behavior, since each control may hold on its own while the combination fails.