Hi, author here (security researcher at Rubrik Zero Labs - this is our blog)! Happy to answer any questions, even though I'm now on a trip in Bryce Canyon ;)

This is my research story - from the beginning, through a root-on-the-AKS-node vulnerability (CVE-2026-32193) and an exploit on Microsoft Copilot.

The Copilot exploit achieves an interactive "shell" in the victim's session through any prompt injection vector (a hidden instruction in a Word document in this specific demonstration).

The chain: prompt injection to code execution in the sandbox, local privilege escalation to root in the sandbox, an unauthenticated daemon on the node with a path traversal, TOML injection into the file it writes, and a symlink to redirect that write onto /etc/ld.so.preload - which gets us root on the Kubernetes node.

Beyond Copilot: the daemon is unauthenticated on localhost on AKS and Container Apps nodes with image streaming, so any SSRF in any workload on such a node becomes root on the node itself.

Demo: https://www.youtube.com/watch?v=Wonbqfi198o

Presented at Black Hat USA 2026. I'll post the presentation here when the Black Hat team releases it.