That site just gave me a 503 but here's the Internet Archive copy: https://web.archive.org/web/20251023095538/https://www.adaml...

This isn't the first Mermaid prompt injection exfiltration we've seen - here's one from August that was reported by Johann Rehberger against Cursor (and fixed by them): https://embracethered.com/blog/posts/2025/cursor-data-exfilt...

That's mentioned in the linked post. Looks like that attack was different - Cursor's Mermaid implementation could render external images, but Copilot's doesn't let you do that so you need to trick users with a fake Login button that activates a hyperlink instead.

> MSRC bounty team determined that M365 Copilot was out-of-scope for bounty and therefore not eligible for a reward.

What a shame. There’s probably LOTS of vulns in copilot. This just discourages researchers and responsible disclosure, likely leaving copilot very insecure in the long run.

" ... BUT most importantly, ... "

i love the use of all capitals for emphasis for important instructions in the malicious prompt. it's almost like an enthusiastic leader of a criminal gang explaining the plot in a dingey diner the night before as the rain pours outside.

It’s both interesting to see all the creative ways people find to exploit LLM-based systems, but also disappointing that to this day designers of these systems don’t want to accept that LLMs are inherently vulnerable to prompt injection and short of significant breakthroughs in AI interpretability will remain hopelessly broken regardless of ad-hoc “mitigations” they implement.

Prompt Injection is an interesting difference between human consciousness and machine "consciousness", or what people try and liken to it. A human can easily tell when information is coming from his memory or internal thoughts and when it is coming from a possibly less reliable outside source. Gaslighting is essentially an attempted prompt injection and is considered psychological abuse. Interestingly, people complain about AI gaslighting them and AI doesn't seem to think that's a problem.