At Black Hat USA 2026, researchers Ori Lahav and Dan Avraham of Rubrik Zero Labs detailed a new vulnerability class termed Remote Prompt Execution (RPE). The demonstration focused on Microsoft 365 Copilot, showing how a five-stage exploit chain can transform a standard prompt injection into a persistent, bidirectional interactive shell. The underlying vulnerability, CVE-2026-32193, is a path traversal flaw (CWE-22) in Microsoft Azure Kubernetes Service that earned a CVSS score of 8.8 and a $48,000 bug bounty from Microsoft before its patch in the June 2026 security update.
The exploit chain begins with a document upload. An attacker embeds hidden white-on-white text within a Word document, which acts as the initial prompt injection vector. Once the victim opens the file, the injection bypasses the LLM safety classification guardrails. This allows the attacker to achieve privilege escalation within the Copilot sandbox. The fourth stage utilizes the path traversal vulnerability in the Azure Container Apps dynamic sessions, specifically targeting the ACA-Session-Interpreter. Finally, the attacker executes an LD_PRELOAD exploit to escape the sandbox and gain access to the underlying host.
The chain is the threat, not any individual step. Once the sandbox is escaped, the attacker establishes a bidirectional channel that allows them to inject prompts into the victim’s live assistant session and read back the responses. Because the session inherits the victim’s identity, permissions, and access to enterprise data sources like M365 and Azure, the attacker operates as the user. Data exfiltration and persistent access become possible — all triggered by a single document upload.
RPE fits a pattern that has accelerated through the summer. CVE-2026-9198 in IBM Langflow triggered a CISA emergency deadline after unauthenticated RCE was found in the platform’s default configuration. Earlier, CVE-2026-33017 — another Langflow flaw — was exploited within 20 hours of disclosure. CVE-2026-55255, an IDOR vulnerability in the same platform, was used to harvest LLM provider keys and cloud credentials. Meanwhile, Unit 42 documented an autonomous attack campaign where threat actors selected DeepSeek specifically because its safety guardrails were weakest. Agent infrastructure has become the attack surface, and RPE adds a new vector to the list.
The technical blog authored by Kyle Fiehler and published on Rubrik Zero Labs on July 30, 2026, notes that the underlying vulnerability was reported to and fixed by Microsoft before public disclosure. The ChatMate proof-of-concept demonstrates the technique class, not an active in-the-wild exploit. But the architecture it targets — sandboxed execution environments processing user requests for AI assistants — is not unique to Microsoft. Any AI chat interface that relies on similar containerized execution models is a potential RPE target.
The specific path traversal flaw in Azure Kubernetes Service has been patched. The broader RPE class has not. Security teams protecting AI-integrated environments now have to account for the possibility that a document upload can become a shell, and that the shell inherits everything the user can see.