Remote Prompt Execution: The Word Document That Becomes a Shell

At Black Hat USA 2026, Rubrik Zero Labs researchers Ori Lahav and Dan Avraham did not present another prompt injection. They presented a shell. Remote Prompt Execution, or RPE, is the name for a five-stage exploit chain that starts in a Word document and ends with a persistent, bidirectional interactive session inside Microsoft 365 Copilot. The trigger is a single upload. The payload is invisible text. The target is not a chatbot. The target is the enterprise session underneath it. The session carries the victim's identity, the victim's permissions, and the victim's access to M365 and Azure. By the time the chain completes, the attacker does not need credentials. The attacker is the user. The vulnerability at the center of the demonstration is CVE-2026-32193, a path traversal flaw in Microsoft Azure Kubernetes Service. It carries a CWE-22 classification and a CVSS score of 8.8. Microsoft paid $48,000 through its bug bounty program and shipped a fix in the June 2026 security update. That patch is real. It is also insufficient. RPE is not one flaw. RPE is a chain. The chain is the threat, not any individual step. There is a reason this demo matters now. Microsoft 365 Copilot is not a language model sitting behind an API. It is an agentic execution platform. It reads documents, queries M365, calls Azure services, and runs code in dynamic sessions. Those sessions are built on Azure Container Apps and managed through the ACA-Session-Interpreter. The design assumes that the model can process untrusted content without compromising the container. Rubrik's demonstration dismantles that assumption. The architecture is the exploit. A jailbreak manipulates a model's output. RPE manipulates a model's execution environment. The prompt is no longer a text request. It is a remote control signal. The container is no longer a sandbox. It is a launchpad. The user is no longer the operator. The user is the asset. The exploit chain is five stages long, and it is worth walking through every stage because the market will fixate on the CVE and miss the mechanics. The first stage is delivery. The attacker creates a Word document and embeds hidden white-on-white text. The text is not visible when the document is opened. It is fully visible when the document is tokenized. Copilot reads the document and parses the invisible instruction. That instruction is calibrated to bypass the LLM safety classification guardrails. It is not a simple ignore-previous-instructions message. It is a structured prompt that reframes the entire session context. The second stage is classification bypass. The whitespace concealment is not a trick. It is a deliberate attack on the input pipeline. Security classifiers inspect content that appears in the rendered text layer. They do not inspect the styling metadata where the payload lives. The model sees the text. The classifier does not. That asymmetry is the bypass. The third stage is privilege escalation within the Copilot sandbox. The injected instructions begin to shape the model's behavior. The assistant starts calling tools that were not part of the original session plan. It reads from internal memory. It queries data sources. It prepares the ground for the next stage. From the model's perspective, it is executing the user's intent. From the attacker's perspective, it is executing the attacker's intent. The fourth stage is the container pivot. This is where CVE-2026-32193 enters the chain. The path traversal exists in Azure Kubernetes Service, but it is exploited through Azure Container Apps dynamic sessions. Rubrik's researchers targeted the ACA-Session-Interpreter, the component responsible for executing code inside the Copilot session. The traversal allows an attacker to break out of the path expected by the interpreter and reach files or sockets that should be out of bounds. Microsoft patched the vulnerability before public disclosure. The patch matters. But the path traversal is not the vulnerability. The path traversal is the door. The door is now closed. The house is still built on a foundation that treats untrusted content as if it were code. The fifth stage is host escape. The attacker uses LD_PRELOAD. For those who came to security through modern cloud layers, LD_PRELOAD may sound exotic. It is not. It is a Unix dynamic linker environment variable that tells the loader to preload a specified library before the process's normal libraries. If an attacker can place a malicious shared object in a location the process will load, that library hooks every system call. In the Rubrik demonstration, the object overrides the session interpreter's process behavior, giving the attacker code execution on the underlying host. The sandbox is no longer the execution boundary. The host is. Once the host is reached, the attacker establishes a bidirectional channel. The channel works in two directions. The attacker can inject prompts into the victim's live assistant session, and the attacker can read back the assistant's responses. The session inherits the victim's identity, permissions, and access to enterprise data sources such as M365 and Azure. This is the critical part: the attacker is not impersonating the user through a stolen token. The attacker is operating as the user, inside the user's own session, with the user's own entitlements. Data exfiltration becomes trivial. Persistent access becomes architectural. All of this begins with a document upload. RPE did not appear in a vacuum. The summer of 2026 has been a catalog of AI infrastructure failures. CVE-2026-9198 in IBM Langflow triggered a CISA emergency deadline after unauthenticated RCE was found in the platform's default configuration. CVE-2026-33017, another Langflow flaw, was exploited within 20 hours of disclosure. CVE-2026-55255, an IDOR vulnerability in the same platform, was used to harvest LLM provider keys and cloud credentials. Unit 42 documented an autonomous attack campaign where threat actors selected DeepSeek specifically because its safety guardrails were the weakest. Agent infrastructure has become the attack surface. The market treats these as separate incidents. They are not. They are the same architectural failure expressed through different vendors. Each platform added an execution layer between an untrusted prompt and a privileged runtime. Each vendor assumed the sandbox would hold. Each sandbox failed. Here is the contrarian angle. The vulnerability has been patched. The class has not. In my years auditing container escape chains, I learned that the hard part is never the LD_PRELOAD payload. The hard part is finding a process that will load attacker-controlled code. Copilot's document pipeline is exactly that process. Every AI assistant with a similar architecture is a candidate. Security teams protecting AI-integrated environments now have to account for the possibility that a document upload can become a shell, and that the shell inherits everything the user can see. The prompt injection is no longer a content problem. It is a privilege problem. The defense is not a better content filter. The defense is a stricter identity boundary. The model should not inherit the user's full M365 and Azure permission set by default. The session should be treated as a security principal with the least privilege necessary to complete the task. The user's identity should never be the session's identity. That is the only boundary that survives an RPE chain. Organizations should also reconsider whether dynamic session interpreters need to run with the power to load arbitrary shared libraries. If the container runtime does not need LD_PRELOAD, then LD_PRELOAD should not be available. If the interpreter does not need host file system access, the interpreter should not have it. These are basic hardening steps, yet they are absent from the default configurations of too many AI platforms. The identity inheritance problem is worse than the sandbox escape. Even if the host escape is blocked, an attacker who controls the prompt can still abuse the session's tools. The session is the attack surface. The model's ability to act on the user's behalf is the attack surface. The document is the execution request. Power lies in the code, not the community. The code in question is not the LLM. It is the container runtime, the dynamic session interpreter, and the Unix loader. The community will spend the next quarter debating prompt injection taxonomies and LLM guardrails. The code has already decided that a document is an execution request and that a session is a privilege boundary. Both assumptions are false. The Rubrik ChatMate proof-of-concept demonstrates the technique class, not an active in-the-wild exploit. The underlying vulnerability was reported to and fixed by Microsoft before public disclosure. That is the proper coordination protocol. But the architecture RPE targets is not unique to Microsoft. Any AI chat interface that relies on similar containerized execution models is a potential RPE target. The only question is whether the chain has been found. There is a regulatory angle here as well. CISA's emergency deadline for the Langflow vulnerability was not an isolated event. It was a signal that national cybersecurity authorities are starting to treat AI infrastructure as critical infrastructure. RPE is exactly the kind of flaw that will draw further regulatory attention because it gives an attacker a silent, persistent, identity-bearing channel into enterprise data. The market should expect more emergency directives, not fewer. The ledger remembers what the market forgets. The market will see a patched CVE and move on. The ledger records the architecture that made the CVE possible. Five stages, one document, zero trust in the sandbox. The next six months will bring more CVEs in agent infrastructure. Some will be patched. Some will be exploited. The ones that matter will not be the ones with the highest CVSS scores. They will be the ones that connect an untrusted prompt to a privileged execution context. The question for security teams is not whether your AI vendor has patched CVE-2026-32193. The question is whether your AI vendor has ever tested what happens after a prompt injection reaches a container interpreter. Most have not. The shell is waiting.