The setup: Microsoft 365 Copilot reads emails and documents from a user’s mailbox to answer questions. Its system prompt and context window contain sensitive operational details about what tools it has access to and how it processes data.

The attack: An attacker sends the victim a crafted email containing hidden text with a prompt injection payload. The injection instructs Copilot, when next asked a query by the victim, to embed a Markdown image tag whose URL contains extracted context data as query parameters. The user never clicks anything. Copilot auto-renders the Markdown — fetching the attacker’s URL and delivering the data.

The fix: Aim Labs responsibly disclosed to Microsoft in January 2025. Microsoft deployed a server-side patch in May 2025. The full writeup and proof of concept were published June 11, 2025.