Prompt injection and Copilot: a rollout risk assessment

Twice in twelve months, a security research firm has published a working data-exfiltration chain against Microsoft 365 Copilot, each with a CVE, each with alarming coverage. The question landing on CISO desks is reasonable: should prompt injection change our Copilot rollout decision? Most of what has been written answers a different question, which is how the exploits worked. This piece answers the one that was asked. It reads the two reference cases as risk evidence rather than news, sets them against the government guidance that now exists, and ends with a ten-question assessment a security lead can put in front of a rollout steering group, with a proceed-or-pause verdict for each row.

The two reference cases, read as evidence

EchoLeak, tracked as CVE-2025-32711, was disclosed by researchers at Aim Security in June 2025 and rated CVSS 9.3. It was the first published zero-click attack on an AI assistant: a crafted email sitting in a user's mailbox could steer Copilot into gathering sensitive tenant content and leaking it to an attacker's server, with the victim never clicking anything. The researchers called the underlying pattern an LLM scope violation, untrusted external content redirecting an AI that holds the user's legitimate access. Microsoft fixed it server-side, and reported no evidence of exploitation in the wild.

SearchLeak, tracked as CVE-2026-42824, came from Varonis Threat Labs in June 2026. One click this time: a link on a legitimate microsoft.com domain, with attacker instructions smuggled through a URL parameter that fed straight into Copilot's prompt, chained with a rendering race condition and a server-side request through Bing to move the stolen data out. Material in reach included mailbox content, meeting details, files, and multi-factor authentication codes arriving by email. Microsoft patched its backend at the start of June 2026, ahead of the 15 June 2026 public disclosure, and again there was no evidence of in-the-wild exploitation.

Set side by side, the two cases share the facts that matter for a risk decision. Both were found by researchers, not incident responders. Both were fixed server-side before any known exploitation, and in both cases tenant administrators had nothing to patch, no update to deploy, no action to take. And both worked by the same mechanism: content from outside the organisation carrying instructions that the assistant treated as if they came from the user.

What that mechanism means for your tenant

Indirect prompt injection is not a bug that was patched twice; it is a property of how retrieval-grounded assistants work. Copilot reads what your tenant receives: email from strangers, documents shared by partners, meeting transcripts, web content. Any of it can carry instructions aimed at the model rather than the reader. Microsoft layers defences against this, classifiers for cross-prompt injection among them, and the two CVEs show both that those defences can be bypassed and that Microsoft closes bypasses quickly when researchers find them.

The tenant-side conclusion is about blast radius, not prevention. What an injected instruction can steal is bounded by what the signed-in user's Copilot can reach, which makes oversharing cleanup a prompt-injection mitigation in its own right. What an injected instruction can do is bounded by whether Copilot merely drafts answers or drives agents that send, write and act. And whether you would ever know is bounded by your logging posture. Those three bounds are tenant decisions, and they are exactly what the assessment below scores.

The Five Eyes guidance, briefly

In May 2026 this stopped being a question governments were silent on. CISA and the NSA, together with the Australian Signals Directorate's Australian Cyber Security Centre, the UK's NCSC and partner agencies from Canada and New Zealand, published joint guidance titled Careful adoption of agentic AI services on 1 May 2026. It names five risk categories for agentic deployments, privilege escalation and cascading failures among them, and its recommendations are notably sober: fit agentic AI into your existing risk framework rather than a new one, start with low-risk and non-sensitive tasks, assume unexpected behaviour, and weight resilience and reversibility over efficiency gains while the field matures.

For an Australian organisation the practical significance is that a measured Copilot rollout now has an authoritative reference point. A board asking whether the organisation is being reckless can be answered with evidence of alignment to ACSC-endorsed guidance, and the assessment below is written to produce that evidence.

The ten-question assessment

Score each row honestly, in writing, with a named owner. Proceed on a row means that dimension supports rollout now; pause means fix the named gap before or during rollout, with the shield pattern below often the fastest fix. A tenant pausing on more than four rows has a readiness problem no vendor patch will solve.

1. 1Data sensitivity in scope. What could a licensed user's Copilot reach today: payroll, legal matters, M&A material, health records? Proceed when the sensitive stores are known and access-controlled. Pause when nobody can answer the question, because injection risk scales directly with reachable sensitivity.
2. 2Label and DLP state. Are sensitivity labels applied to the content that matters, with DLP policies live rather than drafted? Proceed when labels exist on the crown-jewel stores and Copilot honours their protections in your tests. Pause when labelling is a project plan rather than a fact on files.
3. 3Oversharing baseline. Has a Data Access Governance report run in the last quarter, and is the Everyone except external users exposure enumerated? Proceed when the risky-site list exists and is shrinking. Pause when the last permissions audit predates Copilot, and start with Frontrow's shield runbook at /insights/sharepoint-advanced-management-copilot-shield-runbook.
4. 4External content exposure. How much attacker-reachable content flows into what Copilot summarises: external email volume, guest-shared libraries, ingested partner documents? Proceed when high-exposure mailboxes and libraries are identified and, where warranted, excluded from early cohorts. Pause when the first rollout wave includes the inboxes strangers can write to at will, such as sales, recruitment and accounts payable.
5. 5Agent count and creation rights. How many agents exist, who can create them, and what can they touch? Proceed when agent creation is governed and each agent's scope is documented. Pause when any licensed user can stand up an agent against any data source, because agents multiply both the injection surface and the consequence of a successful one.
6. 6Action surfaces. Does the deployment stop at drafting and answering, or do agents send email, write to systems and trigger flows? Proceed when early phases are read-and-draft with a human sending. Pause when autonomous actions are in scope from day one, which is precisely the pattern the joint guidance says to defer.
7. 7Logging and investigation posture. Can you list what Copilot read on behalf of a user last Tuesday, and retrieve the conversation under eDiscovery? Proceed when both have been rehearsed end to end, per the runbook at /insights/copilot-audit-logs-ediscovery-kql. Pause when audit and eDiscovery for Copilot have never been tested, because an incident you cannot investigate is one you cannot close.
8. 8Vendor dependency posture. Both reference CVEs were fixed server-side with nothing for tenants to patch. Proceed when the organisation accepts that model, monitors Microsoft security advisories, and knows this dependency is the same one it already carries for Exchange Online. Pause when the board believes it can patch its way out of AI-layer flaws, because that expectation will fail its first test.
9. 9Incident response readiness. Does the IR plan have a page for suspected AI-mediated exfiltration: who pulls the interaction logs, who suspends licences or applies Restricted Content Discovery, who calls Microsoft? Proceed when the play exists and has an owner. Pause when the current plan would improvise it live.
10. 10User awareness and reporting path. Do users know Copilot output can be manipulated by content in emails and documents, and is there a low-friction way to report an answer that looks steered? Proceed when odd Copilot behaviour has a named reporting channel. Pause when the rollout comms say productivity and nothing else.

The verdict this evidence supports

Prompt injection is a genuine and durable class of risk, and on the evidence to date it argues for a controlled rollout, not a paused one. Two published chains, zero known victims, both closed server-side before exploitation, is a materially better record than the commodity phishing most organisations already live with. More to the point, nearly everything on the tenant side that reduces injection blast radius, oversharing cleanup, labels, scoped agents, tested logging, is work a competent Copilot rollout requires anyway. The organisations with a real decision to make are the ones failing half the rows above, and their problem is readiness, not Microsoft.

The honest caveat runs the other way: this class of attack is young, agentic surfaces are growing faster than any other part of Microsoft 365, and the joint guidance exists precisely because the security authorities expect more of these. The assessment is not a one-off gate. Re-score it quarterly, and re-score it whenever an agent gains a new action or a new data source.