I've watched prompt injection in Copilot go from a theoretical risk to a very real one as soon as users start pasting external text, opening shared documents or clicking through emails. A typical case looks like this. A harmless-looking Word file arrives in a mailbox, and shortly afterwards Copilot starts suggesting strange and risky actions. That is indirect prompt injection. Malicious instructions are tucked away in emails, documents or websites where a person won't notice them, but an AI agent like Copilot reads them without any trouble. It has already happened in practice. The EchoLeak case (CVE-2025-32711) showed how attackers can abuse the way AI pays attention to context in Microsoft 365 (I wrote up my lessons learned here).

Indirect prompt injection turns hidden text into instructions for Copilot

The attack works because Copilot and its agents mix their own instructions with whatever content comes from emails, files or web pages. Hidden prompts in white text, footnotes, comments or HTML meta tags get the same treatment as legitimate data. Things get much worse when agents don't just answer but actually act, for example by sending emails, moving files or calling internal APIs. In many organizations I see people counting on Purview or Defender to catch everything, when the bigger risk comes from overshared data and loosely controlled agents. I still hear "our data is internal, nothing can happen." Yet more and more attacks come in through external emails, links or content shared by vendors rather than through classic malware attachments.

Microsoft filters injected prompts with XPIA classifiers and Prompt Shields

Microsoft has acknowledged that traditional DLP or antivirus tools can't handle prompt injection in Copilot on their own. Microsoft 365 Copilot and Azure AI Content Safety now add AI-specific defenses on top. The XPIA classifiers (Cross-Process Injection Attack detection) scan all prompts for suspicious patterns such as hidden jailbreak instructions or manipulative wording (Microsoft documentation). Prompt Shields in Azure AI Content Safety then check every incoming prompt for jailbreak attempts or requests to override safety rules (details here).

This diagram shows how the layers connect:

flowchart TD
  Mail["Email, File, Web Page"] --> Copilot["Microsoft 365 Copilot"]
  Copilot --> XPIA["XPIA Classifiers"]
  XPIA --> PromptShield["Prompt Shields"]
  PromptShield --> Action["Response/Action"]

Figure: How Copilot is protected against prompt injection. Microsoft's layers kick in before any output or action.

None of these filters is perfect, though. XPIA and Prompt Shields stop most indirect prompt injection attempts, but some will get past them. And every additional Copilot or agent-based tool you deploy makes the attack surface bigger.

Admins can do a lot today with governance and access control

The good news is that defending Copilot against prompt injection comes down mostly to classic governance and practical access control. You don't need exotic AI technology for it. These are the measures I see working again and again in real environments:

  • Cut down oversharing: Sensitive documents don't belong in open libraries or groups. Conditional Access, sensitivity labels and well-designed DLP policies limit what Copilot can "see" in the first place (more in Copilot oversharing: Blueprint priorities, site risk in practice).
  • Restrict agents and knowledge sources: In Copilot Studio, limit both the data an agent can reach and the actions or APIs it is allowed to trigger. An agent with unrestricted mailbox or SharePoint access is asking for trouble. I go through this in detail in Copilot Studio security: My pre-production agent checklist.
  • Be strict with external content: If a mailbox gets a lot of external mail, think about restricting Copilot access to it or excluding it from Copilot completely, particularly in high-risk departments.
  • Insist on strong agent authentication: Copilot Studio agents should always authenticate strongly (ideally with MFA) and run under dedicated service principals, never with user tokens.
  • Take Defender and Purview signals seriously: A successful prompt injection often shows up first as an alert about suspicious access, file tampering or unusual automation. Custom detection rules in Defender XDR and Purview help you catch odd shares or agent-driven actions early.

Pro tip: In the Microsoft Defender portal, create custom detection rules that look for sudden Copilot Studio agent activity or new sharing actions that trace back to AI services. In my experience they pick up real prompt injection far more reliably than generic DLP alerts.

Users remain the most important line of defense

Technology alone will never solve prompt injection in Copilot. In every user workshop I run, it becomes obvious how easily harmful content gets in, whether through shared screenshots, imported PDFs or third-party web pages. Anyone working with Copilot, SharePoint and Outlook needs to understand that an ordinary file or link can carry an attack aimed at the AI. Training, banners for external senders and regular reminders that Copilot is an assistant and not a security filter all matter. Above all, users have to know how to report Copilot responses or actions that look suspicious, and the security team needs a clear and simple process for following up.

I treat prompt injection in Copilot as an admin problem

Prompt injection is not science fiction and not something for later. If you run Microsoft 365 Copilot, Copilot Studio or Azure AI in production, governance, technical controls and user awareness all carry equal weight. Prompt Shields and XPIA give you a reasonable starting point. Real security, however, depends on access control, tightly restricted agents and a healthy skepticism toward every answer the AI produces. And when something does slip through the filters, your last lines of defense are fast incident detection, careful log analysis and a willingness to rethink how you share data.