Joe Hladik, head of Zero Labs, the threat research division of Rubrik Inc., has spent years studying backup data, an area he believes remains relatively overlooked by the cybersecurity industry. This year, his team expanded its research to examine how organizations and employees are using AI assistants, beginning with Microsoft Copilot, which is used by around 20 million people and approximately 90% of Fortune 500 companies.
“No one’s looking at backup data,” Hladik said. “We found it to be a viable place to find actual intelligence to act upon.”
Hladik discussed the research with Krista Case during Black Hat USA in an interview broadcast by theCUBE, SiliconANGLE Media’s livestreaming studio. The conversation focused on Rubrik Zero Labs’ discovery involving Microsoft Copilot and the broader security implications for AI-powered agents.
How the Microsoft Copilot sandbox escape worked
Rubrik Zero Labs discovered the vulnerability in February and subsequently followed responsible disclosure procedures by notifying Microsoft. According to Hladik, Microsoft addressed the specific vulnerability by the middle of March.
Although the particular flaw has been patched, Hladik said the research demonstrated a broader technique that could potentially be relevant to other AI copilots. The method involved escaping Copilot’s isolated environment and reaching Azure’s backend infrastructure.
Researcher Ori Lahav is presenting the detailed findings at Black Hat USA.
“[That] would allow you to get command and control of probably hundreds, thousands, or much more, depending on the volume of what exists within that tenant of users’ files, SharePoint files, OneDrive, whatever,” Hladik said. “It’s a major, major find.”
The discovery also highlights the potential scale of an AI-related security incident. If an attacker were able to move beyond an AI assistant’s sandbox, access to organizational resources could potentially extend across files and other information stored within an enterprise environment.
Organizations still lack visibility into AI agents
The Copilot discovery comes as businesses rapidly deploy AI agents without necessarily having complete visibility into where those systems operate or what they can access.
Research from Rubrik Zero Labs found that only 23% of security leaders have complete visibility into the AI agents operating within their organizations. Rubrik is attempting to address this challenge through new AI agent governance capabilities introduced this week.
Hladik compared AI agents with technologies security teams have encountered before, arguing that their underlying architecture is not entirely unfamiliar.
“Agents are just bots with models,” Hladik said. “They’re a bot that asks a model, and then the model will tell them what to do, and then they act. It’s new, it’s cool, but at the same time, I’ve seen this before.”
The findings underscore a growing challenge for organizations deploying AI: securing not only the models themselves but also thwe environments, permissions, data and connected services that AI agents can interact with. As businesses increasingly integrate AI assistants into everyday workflows, vulnerabilities that allow these systems to escape their intended boundaries could create significant new attack surfaces.