Microsoft 365 Copilot XPIA phishing — attacker-shaped email summaries via hidden instructions
Date: 2026-03
Affected: Microsoft 365 Copilot — enterprise email and Teams users
Attack vector: xss
Category: research-demonstrated
Severity: Critical
CVE: CVE-2026-26133
CWE: CWE-77
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Cross-prompt injection attack (CVE-2026-26133) in Microsoft 365 Copilot email/Teams summarization. Attacker embeds hidden instructions in ordinary emails; Copilot produces convincing phishing content within the trusted summary interface.

Impact: AI-powered phishing inside trusted interface; user trust exploitation; credential theft

Mitigations:
Email content sanitization before AI summarization
Phishing detection in AI-generated outputs
Visual distinction for AI-generated vs original content

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Copilot processes attacker-controlled email content
role: origin
label: Security & Compliance
notes: Phishing content appears as trusted AI-generated summary
role: impact