Microsoft has added a new detection layer to Microsoft Defender for Office 365 that identifies and blocks prompt injection attacks hidden inside inbound email before that content ever reaches a user’s inbox or an AI assistant like Microsoft 365 Copilot.
According to Microsoft, the capability runs inside the existing mail flow inspection pipeline that already screens for phishing, malware, and business email compromise, meaning organizations gain the protection automatically with no additional configuration required.
As enterprises deploy AI assistants to triage, summarize, and respond to email, attackers have shifted their target from the human reader to the language model reading on the human’s behalf.
Microsoft Defender Blocks Email Prompt Injection Attacks
Prompt injection embeds attacker-authored instructions inside a message’s body, subject line, quoted replies, attachments, or hidden markup, aiming to override the AI’s original task.
This differs fundamentally from traditional phishing, which relies on urgency and deception to manipulate a human, whereas prompt injection relies on natural-language commands the model interprets as directives.
Threat actors conceal injected instructions where a person is unlikely to notice, but a model will still process, including white-on-white or zero-size fonts, off-screen HTML/CSS content, instructions buried in forwarded reply chains, payloads embedded in attachments and document metadata, and Base64 or Unicode obfuscation designed to bypass keyword filters.
A successful attack can cause an assistant to leak sensitive mailbox content, misclassify a malicious email as safe, generate misleading summaries, or trigger unwanted actions in automated workflows.
Defender for Office 365 combines large language model classification with existing sender and message signals to evaluate the full message as an AI assistant would receive it, not just the visible body.
According to Microsoft, this includes HTML markup and styling, hidden or invisible text, quoted and forwarded thread content, and encoded or obfuscated segments normalized prior to analysis.
Detected messages are classified under the existing High Confidence Phishing verdict with a new detection technology value, Prompt injection protection, which is filterable within Threat Explorer, real-time detections, and Advanced Hunting.
Microsoft 365 Copilot already includes runtime safeguards such as input filtering, strict separation of user content from system instructions, grounding boundaries, and output filtering.
Defender for Office 365 adds an earlier, distinct layer by inspecting the email channel itself before delivery, so protection applies regardless of which assistant, add-in, or automation later reads the mailbox.
Security teams can further correlate prompt injection alerts with risky users, sessions, and Copilot activity inside Defender XDR, including UPIA and XPIA indicators surfaced in the CloudAppEvents table for deeper hunting.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
