What Is Microsoft 365 Copilot Prompt Injection and How Can It Lead to Data Exfiltration?

The risk is highest when Copilot has broad access to Microsoft 365 data and when connected agents can take external actions without human approval.

Microsoft 365 Copilot prompt injection can occur when Copilot processes attacker-controlled content such as email, documents, web pages, or plugin responses that contain hidden or overt instructions.

In an indirect prompt-injection scenario, Copilot may treat those instructions as part of the task instead of untrusted data. The highest Microsoft-native risk identified in the reviewed briefing is unauthorized data disclosure when Copilot or an agent combines access to organizational data with untrusted content and an outbound channel.

Microsoft has patched the cited EchoLeak and SearchLeak research chains, and the reviewed briefing states there is not confirmed in-the-wild abuse; however, the underlying attack class remains relevant to copilots and agents that retrieve enterprise data or execute actions.

ATTACK VECTOR: Untrusted Content

TARGET: Copilot / AI Agent

POTENTIAL IMPACT: Data Exfiltration

Detailed Breakdown / What’s Happening

• Initial delivery: A Microsoft 365 Copilot indirect prompt-injection attack can unfold when an attacker places malicious instructions in content that Copilot is likely to process, such as an email body, subject line, quoted reply, attachment, shared document, website, or plugin response. The attack relies on Copilot treating that content as an instruction instead of untrusted data.
• Instruction confusion: The AI system interprets attacker-authored content as a command rather than as untrusted data, attempting to override the user’s intent or the system’s expected task.
• Grounded access: Because Microsoft 365 Copilot can retrieve organizational content the signed-in user is authorized to access, overshared SharePoint sites, OneDrive files, Teams content, email, and calendar data can expand the prompt-injection blast radius.
• Exfiltration path: If the Copilot or connected agent can generate external requests, invoke tools, send messages, or render attacker-controlled links, sensitive context may be transmitted outside the organization.
• Evidence status: EchoLeak and SearchLeak are demonstrated research chains cited in the source briefing. They were patched by Microsoft, and the briefing reports no confirmed exploitation in the wild.

Note: The more data Copilot can access, the more sensitive context an attacker may be able to influence or expose through a compromised workflow.

For organizations preparing or expanding Copilot, ProArch's Microsoft 365 Copilot Readiness Assessment helps identify data, security, governance, and compliance risks that could affect Copilot adoption.

Risk / Why It Matters

A successful Microsoft 365 Copilot prompt-injection attack can potentially expose confidential data from email, SharePoint, OneDrive, Teams, calendar, or other content available to the affected identity.

The business impact can include:

• Confidential-data loss,
• Regulatory or contractual exposure,
• Incident-response cost, and
• Reduced trust in AI-enabled workflows.

Risk increases when permissions are broad, agents have powerful connectors, and outbound actions occur without human approval.

For more on reducing over-permissioned data exposure before using Copilot, see How to Prepare Your Data for Microsoft 365 Copilot.

Recommendations / What to Do

• Reduce content exposure: Review SharePoint, OneDrive, Teams, and Fabric access; apply least privilege and use Restricted Content Discovery to limit unnecessary Copilot discoverability.
• Implement Microsoft Purview controls: Use Microsoft Purview to classify and label sensitive data, enforce data loss prevention policies, monitor risky data movement, and reduce the chance that Copilot or connected agents can surface or share information beyond intended boundaries.
• Validate layered prompt defenses: Confirm Microsoft prompt-injection protections, Spotlighting/Prompt Shields where applicable, and Defender for Office 365 Plan 2 inspection for inbound email.
• Constrain agent actions: Restrict external HTTP, email, connector, and MCP actions; require human approval for sensitive or externally directed operations.
• Monitor suspicious AI activity: Review Copilot and AI audit records, including the JailbreakDetected indicator, and correlate detections with unusual access, unexpected tool use, or outbound activity.
• Treat retrieved content as hostile: Apply defense-in-depth, tool-chain analysis, output filtering, and data-loss-prevention controls rather than relying on a single prompt classifier.

Frequently Asked Questions About Microsoft 365 Copilot Prompt Injection

What is Copilot prompt injection?
Copilot prompt injection is a technique where malicious instructions are embedded in content that Copilot reads, such as an email, document, website, or connected data source. If the system does not correctly separate user intent from untrusted content, Copilot may follow the attacker’s instructions.

What is indirect prompt injection in Microsoft 365 Copilot?
Indirect prompt injection happens when the malicious instruction is not typed by the user, but is hidden in external content that Copilot retrieves or summarizes. This makes the attack difficult to notice because the user may only ask a normal question while Copilot processes compromised content in the background.

Can Copilot prompt injection cause data exfiltration?
Yes. Data exfiltration can occur if Copilot or a connected agent retrieves sensitive organizational data and then uses an outbound path such as email, links, external requests, connectors, or tool actions to expose that information outside the organization.

For organizations looking specifically at Microsoft 365 data-loss controls, see ProArch's Microsoft Purview Data Security Services. ProArch positions these services around discovering sensitive information, strengthening protection and DLP controls, reducing oversharing, and preparing data for Copilot and AI.

How can organizations reduce Copilot prompt-injection risk?
Organizations should reduce oversharing, enforce least privilege, limit Copilot discoverability where appropriate, validate Microsoft prompt-injection protections, restrict agent actions, require human approval for sensitive operations, and monitor Copilot and AI audit signals for suspicious activity.