Escalated Privileges in Azure Containers with Python in Excel

A math function in Excel became a path to root in Microsoft's cloud.

SafeBreach Labs researcher Ron Ben Yizhak reverse-engineered the isolated Azure containers behind Microsoft's Python in Excel feature—and found the "isolated" part didn't fully hold.

Cloud isolation claims are a trust boundary. Trust boundaries get tested.

What he found:

• A symbolic link flaw that escalated an unprivileged user to root inside the container
• Root access exposed an internal config file revealing the architecture and hostnames behind the feature
• Microsoft's container images could be pulled anonymously—plus an undocumented AI agent framework baked into the environment
• A bypass of Excel's Trusted Records control (CVE-2026-45459) that forces a victim's machine to silently fetch a URL and upload data to the supposedly network-isolated container

Both issues were responsibly disclosed to Microsoft and patched between March and June 2026, and the research debuted at DEF CON 34.

AI-integrated productivity features and cloud isolation deserve the same scrutiny as any other trust boundary. "Isolated" is a claim until someone validates it.

Read Ron Ben Yizhak's full research here: https://www.safebreach.com/blog/python-in-excel-vulnerability-root-escalation-cve-2026-45459/