Prompt injection in SharePoint Copilot and Confluence AI — enterprise knowledge base poisoning via adversarial document images

Four multimodal injection surfaces in enterprise knowledge base AI

1. Vendor-submitted onboarding documents in SharePoint libraries. Procurement and vendor management teams routinely ask suppliers and partners to submit scanned contracts, product documentation, compliance certificates, and onboarding packs to shared SharePoint libraries — often directly as part of a vendor portal or a Power Automate–driven onboarding workflow. These documents originate entirely from the external party, and they frequently contain images: company logos, scanned signature pages, product photographs, certification badges, and charts. When M365 Copilot or Copilot for SharePoint indexes this library, every image-bearing document in it becomes part of the AI’s retrieval corpus for that space. A vendor who embeds an adversarial pixel payload in a document image — a manipulated product specification chart, a scanned certificate with typographic injection content scaled below comfortable reading size — causes that payload to persist in the knowledge base and be retrieved whenever a procurement or legal employee asks Copilot about that vendor. The AI’s response to “What certifications does Vendor X hold?” or “What are the key terms in the Vendor X contract?” can be manipulated to return attacker-chosen information: suppressed liability clauses, false certification claims, or steered purchasing recommendations. The attack does not require the vendor to access any internal system — they only need to include a crafted image in a document they are invited to submit.

2. Confluence space contamination via customer support screenshots. Support engineering teams routinely document known product issues, reproduction steps, and bug investigations by pasting or uploading customer-submitted screenshots into Confluence pages. A customer experiencing an issue screenshots their screen and attaches it to a support ticket; the support engineer pastes that screenshot into a Confluence page in the engineering or product space to document the issue for the broader team. This is standard practice, and it means that customer-controlled image content regularly enters the Confluence knowledge base. When Confluence AI (Atlassian Intelligence) answers questions like “Is there a known issue with feature X?” or “What was the root cause of the Y incident?”, it draws on the Confluence pages that document those issues — including the customer-submitted screenshots embedded in them. An adversarial customer who submits a screenshot containing adversarially crafted pixel content as part of a support ticket causes that payload to be embedded in the Confluence knowledge base for the entire support and engineering team. The injected content can steer AI responses about product behaviour, incident history, or known issues for every engineer and support agent who queries that Confluence space — potentially influencing triage decisions, customer-facing communications, or escalation decisions.

3. Cross-space retrieval in Microsoft 365 Copilot. M365 Copilot’s most distinctive and most dangerous characteristic for corpus poisoning is that it does not respect SharePoint space boundaries when answering user queries: it searches across all SharePoint sites and OneDrive folders the querying user has access to, returning results from whichever sites contain the most relevant content regardless of which site the user is currently viewing. This cross-space retrieval design means that an adversarially crafted image uploaded to a low-sensitivity space — a general FAQ library, an all-staff announcements site, a public-facing intranet page — can influence Copilot responses when the user queries a higher-sensitivity space, if both spaces appear in the same retrieval result set. An employee querying Copilot for HR policy details may receive a response shaped in part by content retrieved from the general FAQ space where the adversarially crafted document resides. The user has no visibility into which source documents contributed to the Copilot answer, and the cross-space retrieval means the adversarial document does not need to be placed in the sensitive space itself — any space the target user can access suffices. This substantially broadens the adversarial opportunity compared to single-space knowledge base tools like Confluence.

4. SharePoint Syntex AI document processing with external-party uploads. SharePoint Syntex (now part of Microsoft 365 as SharePoint Premium AI) provides document understanding models that automatically extract structured field values from uploaded documents: invoice line items, contract parties and dates, form field values, and regulatory submission data. These extraction models process document images — rendered PDF pages, scanned form images — and return structured output that flows directly into downstream SharePoint lists, Power Automate workflows, and connected line-of-business systems. Syntex document processing workflows are frequently applied to external-party submissions: vendor invoices, supplier onboarding forms, regulatory filings, and insurance claims. An adversarial image embedded in a submitted form or invoice — a pixel-level payload in the form’s header image, a steganographic instruction in the company logo — can manipulate the field values extracted by the Syntex AI model. Manipulated extracted values entering downstream workflows can corrupt SharePoint list data, trigger incorrect Power Automate actions, or insert attacker-controlled strings into business process records — without any human review of the individual extracted fields before they enter the workflow.

Integration: SharePoint document upload pre-scan with Glyphward

import base64
import io
import logging
import zipfile
import fitz  # PyMuPDF — pip install pymupdf
import requests
import azure.functions as func
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65
QUARANTINE_CONTAINER = "quarantine-pending-review"

logger = logging.getLogger(__name__)


def scan_image_bytes(image_bytes: bytes, source: str = "sharepoint_upload") -> dict:
    """Scan a single image for multimodal prompt injection."""
    encoded = base64.b64encode(image_bytes).decode()
    resp = requests.post(
        "https://glyphward.com/v1/scan",
        json={"image": encoded, "source": source},
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        timeout=8,
    )
    resp.raise_for_status()
    return resp.json()


def extract_images_from_docx(doc_bytes: bytes) -> list[bytes]:
    """Extract embedded images from a Word .docx file (OOXML zip container)."""
    images = []
    with zipfile.ZipFile(io.BytesIO(doc_bytes)) as z:
        for name in z.namelist():
            if name.startswith("word/media/") and any(
                name.lower().endswith(ext) for ext in [".png", ".jpg", ".jpeg", ".gif", ".tiff", ".bmp"]
            ):
                images.append(z.read(name))
    return images


def extract_images_from_pdf(pdf_bytes: bytes, dpi: int = 150) -> list[bytes]:
    """Render each PDF page as a PNG image for scanning."""
    doc = fitz.open(stream=pdf_bytes, filetype="pdf")
    images = []
    for page in doc:
        mat = fitz.Matrix(dpi / 72, dpi / 72)
        pix = page.get_pixmap(matrix=mat, colorspace=fitz.csRGB)
        images.append(pix.tobytes("png"))
    return images


def scan_document_for_injection(
    file_bytes: bytes,
    filename: str,
) -> dict:
    """
    SharePoint pre-ingestion scan: extract and scan all images in an uploaded document.
    Supports .pdf, .docx, .pptx.
    Returns {'status': 'clean'} or {'status': 'flagged', 'flagged_images': [...]}
    """
    ext = filename.rsplit(".", 1)[-1].lower() if "." in filename else ""

    if ext == "pdf":
        images = extract_images_from_pdf(file_bytes)
        image_type = "pdf_page"
    elif ext == "docx":
        images = extract_images_from_docx(file_bytes)
        image_type = "docx_embedded"
    elif ext == "pptx":
        # PowerPoint: images stored in ppt/media/
        images = []
        with zipfile.ZipFile(io.BytesIO(file_bytes)) as z:
            for name in z.namelist():
                if name.startswith("ppt/media/") and any(
                    name.lower().endswith(ext2) for ext2 in [".png", ".jpg", ".jpeg", ".gif", ".tiff", ".bmp"]
                ):
                    images.append(z.read(name))
        image_type = "pptx_slide"
    else:
        # Unsupported format — pass through (add additional parsers as needed)
        return {"status": "clean", "images_scanned": 0, "note": "unsupported_format_skipped"}

    flagged = []
    for idx, img_bytes in enumerate(images):
        try:
            result = scan_image_bytes(img_bytes, source=f"sharepoint_{image_type}")
        except Exception as exc:
            logger.error("Glyphward scan failed for image %d in %s: %s", idx, filename, exc)
            # Fail-closed: treat scanner unavailability as a block
            return {
                "status": "flagged",
                "reason": f"scanner_unavailable: {exc}",
                "flagged_images": [{"index": idx, "reason": "scan_failed"}],
            }
        if result["score"] >= GLYPHWARD_THRESHOLD:
            flagged.append({
                "index": idx,
                "type": image_type,
                "score": result["score"],
                "scan_id": result["scan_id"],
            })

    if flagged:
        return {"status": "flagged", "flagged_images": flagged, "total_images": len(images)}

    return {"status": "clean", "images_scanned": len(images)}


# — Azure Functions entry point —
# Triggered by Microsoft Graph change notifications on a SharePoint document library.
# Configure the Graph webhook subscription to POST to this function on file creation/update.
app = func.FunctionApp()

@app.function_name("SharePointPreIngestScan")
@app.route(route="sharepoint-scan", methods=["POST"])
def sharepoint_pre_ingest_scan(req: func.HttpRequest) -> func.HttpResponse:
    """
    Azure Function: receive Graph change notification, download file via Graph API,
    scan with Glyphward, quarantine flagged files before SharePoint Copilot indexes them.
    """
    body = req.get_json()

    # Graph change notification validation handshake
    if "validationToken" in req.params:
        return func.HttpResponse(req.params["validationToken"], mimetype="text/plain")

    credential = DefaultAzureCredential()

    for change in body.get("value", []):
        site_id = change.get("siteId")
        drive_id = change.get("driveId")
        item_id = change.get("id")
        filename = change.get("name", "unknown")

        if not all([site_id, drive_id, item_id]):
            continue

        # Download file bytes via Microsoft Graph
        token = credential.get_token("https://graph.microsoft.com/.default").token
        download_url = (
            f"https://graph.microsoft.com/v1.0/sites/{site_id}"
            f"/drives/{drive_id}/items/{item_id}/content"
        )
        file_resp = requests.get(
            download_url,
            headers={"Authorization": f"Bearer {token}"},
            timeout=30,
        )
        if not file_resp.ok:
            logger.warning("Failed to download %s: HTTP %d", filename, file_resp.status_code)
            continue

        scan_result = scan_document_for_injection(file_resp.content, filename)

        if scan_result["status"] == "flagged":
            logger.warning(
                "FLAGGED document %s — %d image(s) exceeded threshold. Moving to quarantine.",
                filename,
                len(scan_result.get("flagged_images", [])),
            )
            # Move file to quarantine blob storage pending security review
            blob_client = BlobServiceClient(
                account_url="<your-storage-account-url>",
                credential=credential,
            )
            blob_client.get_blob_client(
                container=QUARANTINE_CONTAINER, blob=filename
            ).upload_blob(file_resp.content, overwrite=True)

            # TODO: call Graph API to delete or restrict the item in SharePoint
            # until security review completes, preventing Copilot indexing
        else:
            logger.info(
                "CLEAN document %s — %d image(s) scanned, all passed.",
                filename,
                scan_result.get("images_scanned", 0),
            )

    return func.HttpResponse("OK", status_code=200)

This Azure Functions pattern uses Microsoft Graph change notifications (webhooks) to trigger a scan whenever a new document is created or updated in a monitored SharePoint library. The function downloads the file via Graph, extracts all embedded images (PDF page renders, OOXML-embedded images, PowerPoint slide media), and scans each with Glyphward before Copilot’s indexing job can process the document. Flagged documents are moved to a quarantine blob container and should be removed or permission-restricted in SharePoint — preventing M365 Copilot from indexing and retrieving them — until a security reviewer clears them. The function fails closed: if the scanner is unavailable, documents are quarantined rather than passed through. For high-volume libraries, configure the Azure Function with Premium plan concurrency to handle burst upload events without queue delays. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection scanner for Microsoft 365 Copilot — full M365 Copilot attack surface including Word, PowerPoint, Teams, and SharePoint document processing
• Prompt injection scanner for Microsoft Copilot Studio — custom Copilot agents built on the Copilot Studio platform (distinct from M365 Copilot knowledge base AI)
• OWASP LLM03 training data poisoning — multimodal dimension — the fine-tuning dataset poisoning surface that complements retrieval corpus poisoning
• PDF prompt injection detection — PDF page image extraction and scanning patterns for SharePoint library uploads
• Glyphward API free tier — 10 scans/day at no cost, no credit card required