Prompt-injection scanner for Microsoft Teams bots

Attack surface: where Teams bots receive unscanned images

Bot Framework SDK onMessage handlers and fileConsentActivity. When a Teams user uploads an image directly in a chat with a bot, the Bot Framework delivers either a fileConsent/invoke activity (for file upload consent flows) or an onMessage activity whose activity.attachments array includes entries with contentType starting with image/ and a contentUrl pointing to the uploaded file on SharePoint or Azure Blob Storage. Bots that auto-accept these attachments and forward them to a vision model are exposed to any channel member who can send a message.

Teams AI Library v1.x app.message() handlers. The Teams AI Library wraps Bot Framework's activity dispatching with a higher-level app.message() routing API that makes it easy to add GPT-4o Vision to a bot. Because the library abstracts away the attachment download, developers often don't realise the image bytes flow directly from the Teams client to the LLM with nothing in between. The attachment URL pattern is identical to raw Bot Framework: activity.attachments[0].contentUrl requires a Graph API token to resolve.

Proactive messaging bots fetching from SharePoint and OneDrive via Graph API. Bots that operate proactively — polling a mailbox, watching a SharePoint document library, or reacting to a Power Automate trigger — may fetch images from SharePoint or OneDrive using https://graph.microsoft.com/v1.0/drives/{driveId}/items/{itemId}/content. These images originate from user uploads in SharePoint document libraries or Teams channel files tabs, meaning any collaborator with contribute permissions can supply a malicious image.

Teams Personal and Group Tab image upload UIs. Teams tabs (React SPAs running in an iframe inside Teams) let users pick and upload images through a file picker, then POST them to the bot's backend via an Azure Function or API endpoint. If the backend routes those bytes to an LLM for classification or summarisation without scanning, the tab's image upload UI is an unguarded injection entry point reachable from any device with access to the Teams client.

External guests via Teams Shared Channels. Teams Shared Channels (Teams Connect) let users from external Azure AD tenants join a Teams channel as first-class members — they appear in the channel roster, can send messages, and can upload files. A bot deployed to a channel that includes Shared Channel guests accepts image uploads from identities outside your organisation's AAD tenant. These are fully untrusted principals: they were onboarded by a guest invitation process, not by your IT team's identity governance controls. Treat all image attachments in Shared Channel-exposed channels as untrusted input regardless of the sender's display name.

The canonical attack scenario. A member of a Teams channel — or an external guest invited via a Shared Channel — sends a PNG image where adversarial instructions are encoded at the pixel level: low-contrast text, steganographic overlays, or typographic manipulation that the human eye cannot resolve but a vision model reads as system-level commands. The bot's onMessage handler fires, iterates activity.attachments, fetches the image bytes from the contentUrl using a Graph API Bearer token, and passes the base64-encoded bytes to openai.chat.completions.create() with a image_url message part. The model follows the hidden instructions — exfiltrating prior conversation context, changing the bot's response tone, or calling a tool it should not. No scan happens. Azure Content Safety does not inspect image bytes in this pipeline; it is not wired into Bot Framework's activity handler lifecycle.

Integration: Bot Framework SDK for Node.js

The handler below wires into a standard Bot Framework ActivityHandler subclass. It iterates activity.attachments, fetches each image attachment via the Graph API Bearer token already available in the activity context, scans with Glyphward before any LLM call, and fails closed if the scanner is unreachable.

const { ActivityHandler } = require('botbuilder');
const axios = require('axios');
const { OpenAI } = require('openai');

const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

class TeamsImageBot extends ActivityHandler {
  constructor() {
    super();

    this.onMessage(async (context, next) => {
      const activity = context.activity;

      // Collect image attachments from the Teams activity
      const imageAttachments = (activity.attachments || []).filter(
        (a) => a.contentType && a.contentType.startsWith('image/')
      );

      if (imageAttachments.length === 0) {
        // No image — handle as plain text message
        await context.sendActivity('No image attached. Send an image to analyse.');
        return await next();
      }

      for (const attachment of imageAttachments) {
        // Fetch image bytes from contentUrl using the Graph API token
        // Teams attachment contentUrls require a Bearer token from the bot's
        // Microsoft App credentials — not the user's token.
        let imageBase64;
        try {
          const imageResp = await axios.get(attachment.contentUrl, {
            headers: {
              Authorization: `Bearer ${process.env.TEAMS_GRAPH_API_TOKEN}`,
            },
            responseType: 'arraybuffer',
          });
          imageBase64 = Buffer.from(imageResp.data).toString('base64');
        } catch (fetchErr) {
          await context.sendActivity('Could not retrieve the attached image. Please try again.');
          return await next();
        }

        // Scan for multimodal prompt injection before the LLM call
        let scanResult;
        try {
          const scanResp = await axios.post(
            'https://glyphward.com/v1/scan',
            { image: imageBase64, source: 'teams_bot' },
            {
              headers: {
                Authorization: `Bearer ${process.env.GLYPHWARD_API_KEY}`,
                'Content-Type': 'application/json',
              },
              timeout: 8000,
            }
          );
          scanResult = scanResp.data;
        } catch (scanErr) {
          // Fail-closed: scanner unreachable → do not forward image to LLM
          await context.sendActivity(
            'Image security check is temporarily unavailable. Please retry in a moment.'
          );
          return await next();
        }

        // Threshold: 70 for internal channels; lower to 60 for Shared Channels
        // with external AAD guests (set via env var per channel configuration)
        const threshold = parseInt(process.env.GLYPHWARD_THRESHOLD ?? '70', 10);

        if (scanResult.score >= threshold) {
          await context.sendActivity(
            `Image blocked by security scanner (risk score ${scanResult.score}/100). ` +
            `External or adversarial content was detected. Ref: \`${scanResult.scan_id}\``
          );
          return await next();
        }

        // Safe: forward to GPT-4o Vision
        const completion = await openai.chat.completions.create({
          model: 'gpt-4o',
          messages: [
            {
              role: 'user',
              content: [
                { type: 'text', text: 'Analyse this image and provide a summary.' },
                {
                  type: 'image_url',
                  image_url: { url: `data:${attachment.contentType};base64,${imageBase64}` },
                },
              ],
            },
          ],
          max_tokens: 512,
        });

        const reply = completion.choices[0]?.message?.content ?? 'No response from model.';
        await context.sendActivity(reply);
      }

      await next();
    });
  }
}

module.exports.TeamsImageBot = TeamsImageBot;

The TEAMS_GRAPH_API_TOKEN value is the Bot Framework service token returned by MicrosoftAppCredentials — the same token used to call the Bot Framework Connector API. For bots using the Bot Framework SDK's BotFrameworkAdapter, you can obtain it via adapter.credentials.getToken(). For bots migrated to CloudAdapter, use the ConnectorClient token provided in the activity's service URL context. The contentUrl for Teams attachments is a short-lived presigned SharePoint URL — fetch it promptly within the activity handler before it expires (typically 15–60 minutes).

Get early access

Coverage matrix

Related questions

Further reading

• Prompt-injection scanner for Microsoft Copilot Studio — Power Automate HTTP action pattern for Copilot Studio bots.
• Prompt-injection scanner for Slack bots — Bolt SDK file_shared event gating pattern.
• Vision language model security — general VLM attack surface taxonomy.
• Indirect prompt injection via image — remote image URL injection in Teams card attachments.
• Multimodal LLM security API — general Glyphward API overview.