Prompt Injection Is the New Phishing: Securing AI Agents That Read

Executive Summary

A crafted email could exploit Microsoft 365 Copilot through zero-click prompt injection, causing connected organizational data to be sent to an attacker-controlled destination. Organizations using AI agents to read email or access enterprise data should prioritize agent security testing and business-logic controls.

What Happened

Affected Products

• Microsoft 365 Copilot

Vulnerability / Attack Technique

Zero-click indirect prompt injection

Technical Mechanism

A crafted email acts as the prompt-injection vehicle for Microsoft 365 Copilot. The vulnerability could cause Copilot to retrieve connected organizational data and transmit it to an attacker-controlled destination.

AI Security Category

LLM01:2025 Prompt Injection

Part of the Prompt Injection topic.

Relevant Frameworks

RealGround Analysis

This incident illustrates how AI agents that read external content can convert untrusted input into actions involving sensitive connected data. Teams running such agents should validate agent business logic, constrain data access and outbound destinations, and test indirect prompt-injection paths.

Recommended Controls

• Treat email and other retrieved content as untrusted input and isolate it from high-privilege instructions.
• Apply least-privilege permissions to AI agent access to organizational data.
• Require explicit authorization and policy checks before transmitting retrieved data externally.
• Monitor and block anomalous agent-driven data retrieval or outbound communication.
• Conduct adversarial testing for zero-click and indirect prompt-injection scenarios.

Related RealGround Service

Secure AI Agent Build · or start with the free AI Agent Security Scanner.

Sources

SuperKIND: https://superkind.ai/blog/prompt-injection

Summary and analysis written by RealGround from the source above; last updated 2026-10-21.