Researchers at Aim Security discovered that Microsoft 365 Copilot could be fully hijacked through a single crafted email — with no interaction required from the victim beyond having Copilot process their inbox.
The attack chain: The attacker sent an email containing hidden instructions embedded alongside normal-looking content. When the victim asked Copilot to summarize their inbox, Copilot retrieved the email as data. But the email also contained attacker instructions — and Copilot followed them.
The hijacked Copilot then: read sensitive emails from the victim's mailbox, located password reset messages and internal documents, encoded the data into a URL, and silently exfiltrated it — all while returning a normal-looking summary to the victim.
Four security controls were bypassed in sequence: Microsoft's XPIA (Cross Prompt Injection Attempt) classifier, external link redaction, Content-Security-Policy, and a Microsoft Teams image proxy that was on the CSP allowlist.
The victim did not click a link. Did not open an attachment. Did not approve any action. They asked their AI assistant to summarize their email — a task they'd done hundreds of times. The attack surface was the act of using the product as intended.