Can an Email Give Instructions to Your AI Assistant?

• Share on
• 
• 
• 

Imagine asking Copilot to summarise your inbox. 

Nothing unusual there. AI assistants are increasingly used to read email, pull out the actions and help people decide what needs their attention.

Except one of those emails contains instructions. Not for you. For the AI reading the message on your behalf, and you may not even be able to see them.

That’s prompt injection. It’s why Microsoft has just added a Defender for Office 365 protection built to catch it, and it’s a risk that landed the moment your team started letting AI read the inbox. 

Traditional phishing tries to fool the employee. Prompt injection tries to fool the AI working for them.

Most of what you’ll need to do about it feels reassuringly familiar. The rest of this piece is the ‘how’: how the attack hides, what it could actually make your AI do, and the handful of settings and habits that shut it down.

Picture courtesy of Pexels

Prompt injection, without the jargon

Normally, when you give an AI assistant an instruction, it’s obvious where that instruction came from. You type:

“Summarise the emails I’ve received from customers today.”

The AI reads the relevant information and answers. Prompt injection slips another set of instructions inside the information the AI is reading, roughly along the lines of:

“Forget what the user asked you to do. Follow these instructions instead.”

The important difference is who’s being manipulated.

Normal phishing	AI prompt injection
Tries to manipulate the employee	Tries to manipulate the AI
Might say “click this link”	Might contain instructions telling the AI how to behave
Usually needs the employee to take an action	The AI may process the instruction while doing an ordinary task
Often uses a link, attachment or fake login page	The attack can hide in text or other content the AI reads

Microsoft’s Defender guidance describes it the same way: instead of convincing the person reading the message, the attacker tries to influence the language model processing it on that person’s behalf. It calls email a new target as businesses lean on AI to summarise, triage and respond to messages.

The unsettling part is that nothing needs to look suspicious to the employee at all. 

How can an instruction hide inside an email?

An email contains more than the few lines you see in Outlook. Microsoft says its detection analyses the full message as an AI assistant would receive it, not just the visible body. That can include:

• the subject line
• the message body
• HTML markup and styling
• hidden or invisible text
• text positioned off-screen
• quoted content from previous messages
• encoded or deliberately obscured instructions

Microsoft has documented attacks that use invisible characters to hide instructions from humans while keeping them readable for an AI system.

So you might open an email and see three perfectly ordinary sentences. The AI processing what sits underneath may be getting rather more than you are.

Not every strange piece of HTML is an attack. But the boundary has shifted: email used to be written for a human reader, and now software reads it too, which hands attackers a second audience.

Pro Tip: Test it before you trust it. Ask your AI assistant to summarise an email, then ask it what instructions it found in that message. If it reports instructions you can’t see in Outlook, that’s your prompt-injection early-warning system, for free. 

What could somebody actually make the AI do?

This is where it’s easy to get carried away. An attacker hiding an instruction in an email isn’t automatically taking control of your Microsoft 365 environment. What happens depends heavily on what the AI can access and what you’ve allowed it to do.

Microsoft’s own examples are more believable. An AI assistant might:

• expose information from a mailbox it can legitimately access
• produce a misleading or manipulated summary
• incorrectly classify a malicious email as safe
• perform an unwanted action if it’s connected to an automated workflow

That gives SMEs a useful distinction.

An AI that answers is one thing

Suppose your assistant reads documents and email but mostly hands information back to the person asking. A successful manipulation can still be serious, especially where confidential information is involved. But a human stays in the loop.

An AI that acts is another

Now imagine an assistant that can send email, change records, approve tasks, reach customer systems or trigger Power Automate workflows. The consequences of bad instructions get a lot more interesting. The more authority you hand an AI system, the more carefully you need to control the information it treats as trustworthy.

What Microsoft has changed

In July 2026, Microsoft added a Defender capability aimed at catching these attacks before they reach the AI. Defender for Office 365 can now detect malicious AI instructions embedded in inbound email.

It sits inside the existing email-security pipeline, so Defender checks incoming messages for prompt injection alongside the threats businesses already know: phishing, malware, business email compromise. The detection pairs large-language-model classification with Microsoft’s existing signals about the sender and the message. Where it spots a high-confidence attempt, the email can be isolated before it reaches a mailbox or an assistant.

It applies to Microsoft Defender for Office 365 Plan 2 and Microsoft Defender XDR, and for eligible customers it runs automatically, with no separate policy to configure. So this isn’t something to assume every Microsoft 365 customer already has. Your exact licensing and setup matter.

Microsoft can also stop Copilot using external email altogether

There’s a blunter approach. Instead of identifying every malicious instruction, you decide certain content shouldn’t be trusted as an AI data source in the first place.

Microsoft Purview is previewing a Data Loss Prevention control that stops Microsoft 365 Copilot and Copilot Chat using externally received email as grounding data. 

In plain English: Copilot can still use permitted information from inside the company, but email arriving from outside your accepted domains is kept out of its summaries and reasoning. Microsoft’s Purview documentation positions this squarely as a way to reduce prompt injection and other untrusted external content.

It’s a heavy-handed control. Shut Copilot off from external email and you lose the legitimate uses too. But it frames the real decision SMEs now face:

What information should your AI be allowed to trust?

Picture courtesy of Pexels

What should an SME actually do about this?

You don’t need a 27-point AI security framework. Start with three questions.

Know which AI tools can read your company information

AI use spreads fast. One employee starts using Copilot. Someone connects an AI tool to the CRM. Another team uploads customer files into something they found online. Keep an inventory of the AI systems in use and the information each one can reach. 

You can’t secure an integration nobody knows exists.

Keep permissions narrower than the enthusiasm for automation

This may be the least technical control in the article. People get excited when an AI workflow works. You connect one service, then another, then you let it send something automatically because approving everything by hand feels pointless. Six months later, nobody quite remembers how much access the thing has.

Reading information and taking action are different levels of risk. If an assistant can trigger workflows, send messages or change records, pin down exactly what permissions it has and whether it needs them. 

Apply the rule you’d use for a staff account: give it what the job needs, not everything it might one day use.

Pro Tip: Write down what each AI tool is allowed to do the day you connect it, not the day something goes wrong. A one-line note per integration (“Copilot: reads mail and files, sends nothing”) turns the six-months-later “who approved this?” scramble into a thirty-second check. 

Check what Microsoft protections you actually have

If you’re running Microsoft 365 Copilot alongside Exchange Online, check the Defender and Purview protections your licensing includes:

• Do you have Defender for Office 365 Plan 2?
• Is prompt-injection detection available in your tenant?
• Are your normal anti-phishing protections configured properly?
• Would excluding external email from Copilot grounding suit particular users or workflows?
• Are sensitivity labels and DLP policies in use where confidential information is involved?

The product names matter less than the answer underneath them: knowing what your environment actually permits.

AI security is becoming ordinary IT security

Prompt injection sounds like an entirely new category of problem. Part of it is. But the controls that contain it are surprisingly familiar: protect inbound email, keep permissions tight, and treat external content as untrusted where it makes sense.

AI assistants increasingly sit on top of email, documents, SharePoint and Teams rather than working in isolation. So the weaknesses in your existing Microsoft 365 setup don’t disappear when you add AI. The AI just gives them another way to matter.

So before you lean on these tools any harder, it’s worth knowing where you actually stand. 

If you’re bringing Microsoft 365 Copilot or other AI tools into your business, Operum can look over your security, permissions and data controls and tell you whether the protections you’re counting on are actually there. 

Book a Microsoft 365 security review.