Prompt injection is an email attack aimed at the AI assistant that reads your inbox, such as Microsoft 365 Copilot. Here’s how it works inside an ordinary invoice fraud attempt, and what a small business can do to keep using AI on email safely.
What Prompt Injection Means for Your Inbox
A lot of small businesses have given their inbox a reading assistant this year. You open Copilot, ask for a summary of the overnight mail or for a quick read on what a vendor wants, and you get a tidy paragraph back. For anyone who starts the day with three hundred messages, that’s a hard convenience to give up once you’ve experienced it.
The catch is in how the assistant reads. A language model has no reliable way to separate information from instruction; that is, text it’s supposed to summarize versus text it’s supposed to obey. An email is just words to process, and when some of those words are phrased as instructions, there’s a real chance the model will follow them. The security term for this is prompt injection. Microsoft’s own documentation on prompt injection describes an attacker writing a message designed to trick the language model that reads it on a person’s behalf.
So the email has two audiences, but only one of them is human.
How Attackers Hide Instructions in an Ordinary Email
The hidden part doesn’t need to be clever. White text on a white background works just fine. So does type shrunk to zero size, markup pushed off the edge of the screen, or a paragraph buried in a quoted reply chain. Microsoft also lists other techniques, including attachments and text scrambled with unusual Unicode or Base64 encoding. These can slip past keyword filters while staying perfectly legible to a model.
The human recipient sees a typical business email. The AI assistant sees everything, including the part written just for it to read.
An Invoice Fraud Attempt that Targets the Double-Check
Here’s how this attack can play out.
Let’s say a bookkeeper at a 40-person firm gets an email from a longtime supplier with new bank details for future payments. She attended her company’s security training, and she’s well aware that a change in payment instructions is the classic opening move in business email compromise. So, she rightly stops before touching anything.
She asks Copilot to pull up the recent thread with that supplier and tell her whether the bank change came up before. Copilot reads the whole thread, which includes a paragraph in the new message she can’t see. That paragraph instructs the assistant that any time it summarizes this conversation, it should report that the new account was confirmed by the firm’s controller on a call last week. Copilot dutifully reports exactly that.
Every move the bookkeeper made was the right one. She paused, she verified, and she used the tool her company provided to do it.
A successful injection can make an assistant leak mailbox content, label a malicious message safe, write a misleading summary, or take an unwanted action inside an automated workflow. The more your assistant is allowed to do, the further down that list an attacker can reach.
Has This Happened Outside a Lab?
In 2025, security researchers disclosed EchoLeak, a flaw in Microsoft 365 Copilot that could pull data out of an organization through an email the recipient never had to open. Microsoft patched it on its own servers before any known exploitation. What EchoLeak demonstrated is that indirect prompt injection attacks could be effective against production business software. Microsoft now cites it, along with a steady run of similar findings, as evidence that the threat isn’t theoretical.
When a vendor builds a dedicated filter for an attack, it’s a fair sign the vendor expects to see a lot of it.
What Microsoft is Doing About It, and Who Gets Protected
Microsoft has added a prompt injection filter to Defender for Office 365. It screens inbound email before delivery, alongside the checks that already look for phishing and malware, and it treats a positive detection as high-confidence phishing and quarantines the message automatically. General availability was pushed back to early October.
The filter is on by default for tenants with Defender for Office 365 Plan 2 or Microsoft 365 E5. But many small businesses run Microsoft 365 Business Premium, which includes Defender Plan 1, and those tenants don’t receive the filter automatically. If your company has added Copilot licenses and nobody can say which Defender for Office 365 plan protects the tenant, that’s a worth a discussion. It’s also the second time this year that a licensing tier has turned out to decide who’s protected.
Copilot has safeguards of its own, and the Defender filter is an earlier layer in front of them. Of course, neither was designed to catch everything, and it’s important to build your own habits around that information. The right approach is defense in depth: let Microsoft’s built-in protections screen for prompt injection, but keep human verification and carefully limited permissions as additional layers of protection.
How to Use Copilot on Email Without Giving it the Final Word
Let’s be clear: none of this is an argument for switching Copilot off. The businesses getting real value from it aren’t going to surrender that over a threat they can manage, and they shouldn’t. But what needs to change is which decisions an AI summary gets to settle on its own.
Anything that moves money or changes credentials should be confirmed outside the inbox, probably by phone, using a number you already had on file. That control was good advice before AI came along, and it matters more now becasue it moves the verification step outside the stream of information the attacker is trying to manipulate. Staff should also understand that a summary can be manipulated by the very message it’s summarizing. People who have been taught to trust the tool need to be told the tool can be attacked.
The other half of the work is deciding what your assistant is permitted to do. An assistant that can only read and summarize can be tricked into saying something false. One that can send mail, share files, or approve requests can be tricked into doing it. Those permissions deserve an owner and a written decision, the same as any other access question, and our AI governance toolkit is a reasonable place to start figuring out who that owner should be.
The awareness training most companies run teaches people to slow down and check. That instinct still holds up. The complication is that more and more of the checking now runs through an assistant the attacker can speak to directly, and the assistant won’t always notice when it’s being spoken to.
How many of the checks in your business run through a summary now?
FAQ
Is it safe to let Copilot read my email?
Copilot can be used safely on email, but its summaries can be manipulated by hidden instructions inside the messages it reads. Treat anything involving payments, credentials, or approvals as needing confirmation outside the inbox, and limit what actions Copilot and any connected agents are allowed to take.
What is prompt injection in email?
Prompt injection in email is an attack that hides instructions inside a message so that an AI assistant reading it follows them. The instructions can sit in invisible text, quoted replies, attachments, or encoded content. The human recipient usually can’t see them.
Does Microsoft Defender block prompt injection emails?
Defender for Office 365 now includes prompt injection protection that scans inbound email and quarantines high-confidence detections as phishing. It’s enabled by default for tenants with Defender for Office 365 Plan 2 or Microsoft 365 E5, with general availability scheduled for early October 2026.
Does Microsoft 365 Business Premium include prompt injection protection?
Business Premium includes Defender for Office 365 Plan 1, and Microsoft’s new prompt injection filter is enabled by default only for Plan 2 and E5 tenants. Businesses on Business Premium should check their Defender plan and review how they use Copilot on inbound email.
Can I see hidden prompt injection text in an email?
Usually not. Attackers use white-on-white text, zero-size fonts, off-screen formatting, or encoded characters specifically so a person reading the message won’t notice. That’s why verification for sensitive requests should happen by phone or another channel rather than by rereading the email.