Confused Deputy Copilot in three examples

I just stumbled upon an excellent 3-parts series of (responsibly disclosed) attacks impacting Microsoft Copilot. The first one is poisoning Copilot memory via an attacker-controlled webpage, which allowed the instruction to gain persistence in the victim&apos;s ecosystem. As explained in the SociaLLM article, there is only