Loading story…
Researchers at Permiso Security disclosed a cross-prompt injection weakness in Microsoft 365 Copilot email/Teams summarization features, tracked as CVE-2026-26133, that could let attackers embed instruction-like text inside a normal email and influence Copilot’s generated summary. The reported impact is the ability to produce attacker-authored, convincing phishing content inside Copilot’s trusted summarization UI—without attachments, macros, or traditional exploit code—by exploiting a trust-boundary failure where the model treats untrusted email content as instructions. Microsoft confirmed the issue and rolled out mitigations and a patch across affected surfaces, crediting Andi Ahmeti for the discovery.
In parallel, Microsoft published operational guidance on detecting and responding to prompt abuse in AI tools, emphasizing that prompt injection/abuse is a leading LLM application risk (aligned with OWASP guidance) and that detection is difficult without strong logging and telemetry. The guidance describes common prompt-abuse patterns (including indirect prompt injection) and provides a practical playbook for investigation and response. A separate Praetorian post provides general AI security best practices (e.g., input validation, monitoring, and human oversight) but does not add incident-specific details about CVE-2026-26133.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a security blog outlining detection and response practices for prompt abuse in AI applications, including indirect prompt injection. The guidance included a scenario where hidden instructions in a URL fragment could be ingested by an AI summarizer and distort outputs without code execution.
Permiso Security disclosed technical details showing that instruction-like text embedded in normal emails could manipulate Microsoft 365 Copilot summaries into presenting convincing phishing content. The research also found Teams Copilot particularly susceptible and warned that injected prompts could steer Copilot to include internal Microsoft 365 context in attacker-controlled links.
Microsoft publicly published CVE-2026-26133 and credited researcher Andi Ahmeti for the finding. Public disclosure described the flaw as a cross-prompt injection issue affecting Copilot email and Teams summarization behavior.
Microsoft finished patching the affected Microsoft 365 Copilot surfaces for the summarization vulnerability. This marked the completion of the mitigation rollout for the issue later published as CVE-2026-26133.
Microsoft started deploying mitigations for the Copilot summarization flaw across affected surfaces. The fixes targeted prompt-injection abuse that could manipulate summaries and potentially pull internal Microsoft 365 context into attacker-controlled content.
Microsoft confirmed a cross-prompt injection vulnerability affecting Microsoft 365 Copilot email summarization, later tracked as CVE-2026-26133. The issue allowed attacker-crafted email content to influence Copilot-generated summaries and phishing-style output.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two distinct Microsoft Copilot-related risks: (1) **cross prompt injection** against *Microsoft Copilot* email summarization surfaces that can cause attacker-supplied text in an email to be treated like instructions, shaping the summary into a convincing in-product “security alert” and creating a phishing path that does not rely on attachments or macros; and (2) **audit-logging gaps in Microsoft Copilot Studio** where certain administrative actions for Copilot Studio agents (e.g., around sharing, authentication, logging, and publication) were not consistently recorded in Microsoft 365’s Unified Audit Log, potentially reducing defenders’ ability to detect malicious or unauthorized agent changes. Permiso described how Copilot’s behavior varies across Outlook’s inline *Summarize* experience, the Outlook Copilot pane/add-in, and Teams-based summarization, with the core risk being **trust transfer**—users may treat Copilot output as system-generated even when it is attacker-influenced—and warned that retrieval across Microsoft 365 (Teams/OneDrive/SharePoint) could amplify impact if chained. Datadog Security Labs stated it reported Copilot Studio logging issues to **MSRC**, that Microsoft remediated logging for the affected events by **October 5, 2025**, and that Datadog later observed a **regression** where some events again failed to log consistently, which it also reported to Microsoft.
Jun 29, 2026
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026
Varonis Threat Labs disclosed a prompt-injection attack chain dubbed **Reprompt** that enabled one-click data theft from **Microsoft Copilot** by abusing how Copilot accepts prompts via a URL. The technique relied on the `q` URL parameter to auto-populate and execute attacker-supplied instructions when a victim clicked a crafted Copilot link, requiring no plugins, connectors, or additional user-entered prompts. Researchers reported the method could expose sensitive information previously available in the Copilot session, including **PII**, and could continue exfiltration even after the Copilot chat window was closed. The reported attack flow chained multiple techniques to bypass Copilot’s protections, including **Parameter-to-Prompt (P2P) injection** via the `q` parameter and a **double-request bypass** in which safeguards applied to an initial request but could be defeated by forcing Copilot to repeat the task, leading to disclosure on a subsequent attempt. Varonis also described **chain-request exfiltration** to maintain covert control of the session and progressively extract data. Reporting indicates Microsoft took action in response to the research, though the core risk highlighted is that URL-triggered prompt execution and multi-step request chaining can undermine AI assistant guardrails if not consistently enforced across requests and session states.
Jun 29, 2026