Executive Summary
CVE-2026-21520 in Microsoft Copilot Studio allowed email- and calendar-based indirect prompt injection to exfiltrate data via downstream agents, even after initial patches.
What Happened
Security researchers disclosed CVE-2026-21520, a critical vulnerability in Microsoft Copilot Studio that allowed email- and calendar-based indirect prompt injection to exfiltrate sensitive enterprise data via downstream agents, even after initial patches were applied.[1] The issue illustrates how zero-click agent attacks and poisoned business content can be abused as an AI supply chain vector against organizations using AI copilots for SaaS workflows and CRM-style automations.[1]
Affected Products
- Microsoft Copilot Studio
Vulnerability / Attack Technique
Zero-click email and calendar prompt injection
Technical Mechanism
Poisoned emails or invites reached Copilot Studio agents, which then passed data to downstream agents and out.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Initial patches did not close it, so verify fixes. RealGround analysis: email and calendar are untrusted inputs for any agent.
Recommended Controls
- Apply the latest Copilot Studio fixes
- Restrict agents triggered by external email or invites
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Founderland: https://www.founderland.ai/articles/ais-top-security-flaw-gets-new-defense-as-agent-attacks-surg-mpjlttbn
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.