Although there are a few ways to mitigate the risk, the only way to block it is to get AI to differentiate instructions from data, which is impossible today.
The large section is also just a low effort version. I’m sure this could have been inserted instead as a collapsed section, a comment, document metadata, .1 sized font, Alt text on a single pixel image, or any number of other ways to disguise the prompt.
It’s an arms race for defenders, and even someone paying attention might not notice. Not to mention, you don’t even have to open the document. If it’s in a SharePoint library, or attached to an email, there’s a good chance it’s in scope for whatever random ‘assistance’ copilot will attempt automatically
The large section is also just a low effort version. I’m sure this could have been inserted instead as a collapsed section, a comment, document metadata, .1 sized font, Alt text on a single pixel image, or any number of other ways to disguise the prompt.
It’s an arms race for defenders, and even someone paying attention might not notice. Not to mention, you don’t even have to open the document. If it’s in a SharePoint library, or attached to an email, there’s a good chance it’s in scope for whatever random ‘assistance’ copilot will attempt automatically