A now patched flaw in Microsoft 365 Copilot let attackers turn its diagram tool, Mermaid, into a data exfiltration channel–fetching and encoding emails through hidden instructions in Office documents.

Mermaid, the open source diagramming and charting tool, has long been popular with developers for its ability to create diagrams using a Markdown-like language. As is often the case, Mermaid founder ...