Microsoft Copilot Studio Zero-Click Email Injection Tracked as CVE-2026-21520

Security researchers disclosed CVE-2026-21520, a critical vulnerability in Microsoft Copilot Studio that allowed email- and calendar-based indirect prompt injection to exfiltrate sensitive enterprise data via downstream agents, even after initial patches were applied.[1] The issue illustrates how zero-click agent attacks and poisoned business content can be abused as an AI supply chain vector against organizations using AI copilots for SaaS workflows and CRM-style automations.[1]

The article reports on CVE-2026-21520 as a critical flaw in Microsoft Copilot Studio where email and calendar content could be abused for indirect prompt injection, enabling zero-click agent attacks and sensitive data exfiltration via downstream agents even after initial vendor patches.[1][10][13] Public vulnerability feeds classify CVE-2026-21520 as a high-severity information disclosure issue over a network vector with no required privileges or user interaction, impacting confidentiality in Copilot Studio.[1][4][11] From a RealGround perspective, this demonstrates that business content and SaaS workflows (e.g., email, calendar, SharePoint forms) can act as an AI supply chain attack surface, requiring hardening of agent triggers, default-deny on risky actions, strict allowlisting of outbound connectors, and continuous red teaming focused on indirect prompt injection patterns.[8][10][13] Organizations using AI copilots for CRM-style and SaaS automations should treat internal data sources as potentially hostile, implement robust egress controls and least-privilege scopes for agent tools, and subject Copilot/agent configurations to structured business logic audits and SBOM-style supp