Microsoft Copilot for Word Vulnerability Allows Hidden Prompt Injection and Propagation
Security researcher Håkon Måløy disclosed a prompt injection vulnerability in Microsoft 365 Copilot for Word that allows hidden instructions in a document…
Tag: Microsoft 365 Copilot
Agent Data Injection (ADI) Attack: How AI Agents Can Be Tricked Into Misclicking or Running Attacker Commands
A new class of attack called Agent Data Injection (ADI) has been disclosed by researchers from Seoul National University, the University of…
MemGhost Attack: One Email Plants Persistent False Memories in AI Agents
A new attack named MemGhost demonstrates how a single email can inject persistent false memories into AI personal assistants, manipulating their future…
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
Microsoft has issued a warning about a new attack vector targeting AI agents that use the Model Context Protocol (MCP). Attackers can…
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
A critical vulnerability in Microsoft 365 Copilot Enterprise Search, dubbed SearchLeak, could have allowed attackers to exfiltrate emails, files, and MFA codes…
CVE-2026-42824: Microsoft 365 Copilot Enterprise Search Vulnerability
A critical command injection vulnerability in Microsoft 365 Copilot Enterprise Search, discovered by Varonis Threat Labs, allows one-click data exfiltration. Microsoft assigned…
CVE-2025-32711: EchoLeak Vulnerability in Microsoft 365 Copilot
EchoLeak is a prompt injection vulnerability in Microsoft 365 Copilot disclosed by Aim Security in June 2025. An attacker could craft an…
Microsoft 365 Copilot
An AI-powered assistant integrated into Microsoft 365 apps, including Word, that can draft, edit, and summarize content based on user prompts and…