You secure Microsoft 365 Copilot and AI agents against prompt injection and data exfiltration by treating it as a defense-in-depth problem, not a model problem: Microsoft ships layered platform protections, and you layer your own governance controls on top so that when the model is tricked, nothing sensitive leaves the tenant. Prompt injection is the top-ranked risk in the OWASP Top 10 for LLM Applications, and it is the same technique behind EchoLeak, the first real-world zero-click exfiltration attack against a production Copilot.

This guide is written for the CISO, IT director, and AI Center of Excellence owner who has to sign off on a Copilot or Copilot Studio deployment and needs a defensible answer to one question: what actually stops an attacker from turning our AI assistant against our own data? We cover how the attack works, what Microsoft handles for you, the controls you must configure yourself, and a practical checklist for custom agents.

Key takeaways

• Prompt injection is the number-one LLM risk two years running. It ranks first in both the 2025 and 2026 OWASP Top 10 for LLM Applications, with sensitive information disclosure second and excessive agency now third.
• The real damage is data exfiltration, not a rude chatbot. A successful injection can make Copilot find sensitive content the user can access and smuggle it out through image tags, links, or tool calls.
• EchoLeak proved zero-click exfiltration is possible. A single crafted email (CVE-2025-32711, CVSS 9.3) exfiltrated data from Microsoft 365 Copilot with no user interaction before Microsoft fixed it server-side.
• Security is shared. Microsoft manages model-level defenses like Spotlighting and Prompt Shields; you own the tenant controls — Purview DLP, sensitivity labels, oversharing cleanup, and agent scoping.
• Build for blast-radius control. OWASP's own guidance is to stop trying to build a model that cannot be fooled and instead design the system so that when it is fooled, nothing important breaks.
• Custom Copilot Studio agents widen the attack surface. Every connector, knowledge source, and action you add is a new path an injected instruction can abuse, so scope and govern each one.

The short answer: what secures Copilot against prompt injection

There is no single switch. Securing Copilot and AI agents against prompt injection and data exfiltration means combining defenses across four layers, most of which map to controls you already own in Microsoft 365.

• Prevent: harden how untrusted content is handled — Microsoft's Spotlighting and hardened system prompts, plus your own scoping of what data and tools an agent can touch.
• Detect: classify and flag injection attempts with Microsoft Prompt Shields and prompt-injection protection in Microsoft Defender for Office 365.
• Contain: stop data from leaving with Microsoft Purview DLP, sensitivity labels, link and Unicode redaction, and deterministic blocking of known exfiltration channels.
• Govern: reduce exposure before an attack with oversharing cleanup, Restricted Content Discovery, audit logging, and least-privilege agent design.

What is prompt injection, and why does it threaten Copilot?

Prompt injection is an attack where adversarial text is misinterpreted by a large language model as legitimate instructions, hijacking its behavior. Because instruction-tuned models like the ones behind Copilot are designed to follow natural-language commands, they cannot reliably tell the difference between your instructions and instructions hidden inside the content they are asked to process.

Copilot raises the stakes because it is a retrieval-augmented (RAG) system wired into Microsoft Graph — your mailbox, OneDrive, SharePoint, and Teams. That deep reach is what makes it useful, and also what makes a successful injection dangerous: the model already has permissioned access to sensitive data, so an attacker who controls its instructions can point that access at their own goals. Microsoft's security research names data exfiltration and unintended actions as the two headline impacts in its indirect prompt injection defense guidance.

Direct vs. indirect prompt injection compared

Direct injection (UPIA, User Prompt Injection Attack)

• Who attacks: The user themselves types a malicious or jailbreak prompt into Copilot.
• Typical goal: Bypass guardrails, extract the system prompt, or coax disallowed output.
• Primary defense: Model-level classifiers, block lists, and Responsible AI filtering that Microsoft manages.

Indirect injection (XPIA, Cross-Prompt Injection Attack)

• Who attacks: A third party plants instructions in content Copilot later reads — an email, document, webpage, or tool response.
• Typical goal: Silent data exfiltration or unintended actions performed with the victim's permissions.
• Primary defense: Spotlighting to isolate untrusted input, Prompt Shields, DLP, and containment controls you configure.

Indirect injection is the harder problem and the one enterprises underestimate, because the malicious instruction never passes through a person who might notice it.

What was EchoLeak, and what did it teach us?

EchoLeak (CVE-2025-32711) was a zero-click indirect prompt injection vulnerability in Microsoft 365 Copilot, disclosed by Aim Security researchers in June 2025 and described in a peer-reviewed case study as the first real-world zero-click prompt injection exploit in a production LLM system. An attacker emailed the victim a message containing hidden instructions; when Copilot later pulled that email into its RAG context, it executed the attacker's commands and exfiltrated sensitive data — with no click, open, or action from the victim.

What makes EchoLeak instructive is how it defeated existing guardrails. According to Cato Networks' technical breakdown, the attack evaded Microsoft's XPIA classifier by phrasing the injected text as if it were addressed to a human recipient, then slipped data out using reference-style Markdown links that Copilot's link redaction did not catch. Aim Security called the underlying flaw an "LLM Scope Violation": untrusted, external content caused the model to reach into trusted, internal data without the user's consent — a breach of least privilege. Microsoft rated it critical (CVSS 9.3) and remediated it server-side, with no customer action required.

Stop trying to build a model that cannot be fooled; build the system around it so that when the model is fooled — and it will be — nothing important breaks.

That principle, drawn straight from OWASP's 2026 guidance, is the whole game. EchoLeak was patched, but the class of attack is permanent, so your defense has to assume the model can be tricked and focus on limiting what happens next.

How does Microsoft defend Copilot out of the box?

Microsoft applies a defense-in-depth strategy that spans prevention, detection, and impact mitigation, using both probabilistic defenses (which reduce the odds of an attack) and deterministic defenses (which structurally guarantee a specific attack cannot succeed). These are described in Microsoft's Copilot prompt defense in depth documentation and its Zero Trust guidance for indirect prompt injection.

• Spotlighting and hardened system prompts isolate untrusted input so the model treats retrieved content as data, not commands.
• Microsoft Prompt Shields — part of Azure AI Content Safety — detect injection and jailbreak attempts and integrate with Microsoft Defender for Cloud for enterprise-wide visibility.
• Prompt injection protection for email in Microsoft Defender for Office 365 Plan 2 flags injection content in inbound mail before it can reach a user or an AI assistant.
• Runtime protections across five stages — prompt input, ingress, grounding, web search, and response egress — apply block lists, Responsible AI classifiers, hidden-Unicode sanitization, and tool-chain analysis throughout the request lifecycle.
• Prompt injection audit logs record attempts, including a JailbreakDetected flag, so security teams can investigate risky AI interactions.

These protections are strong, but Microsoft is explicit that some controls it manages and others you must configure — and that several depend on your Purview, Defender, and licensing posture.

What controls do you have to configure yourself?

This is where most Copilot risk actually lives. Copilot honors the permissions a user already has, so pre-existing oversharing becomes far easier to surface — and an injection attack turns that latent exposure into active leakage. The containment layer is yours to own.

Microsoft-managed vs. customer-configured controls

Microsoft manages

• Model defenses: Spotlighting, hardened system prompts, Prompt Shields, Responsible AI classifiers, and block lists.
• Deterministic exfiltration blocking: redaction of known external link formats and sanitization of hidden Unicode instructions.

You configure

• Microsoft Purview DLP for Copilot: block files and emails carrying sensitivity labels from being grounded, and stop sensitive data from entering prompts or web queries.
• Oversharing and discovery controls: remediate broad SharePoint permissions and apply Restricted Content Discovery to limit what Copilot can surface without changing site permissions.
• Exposure reduction: exclude up to 1,000 sites from web grounding via domain exclusion, and turn off web grounding entirely where required (it is already off by default for GCC, GCC-High, and DoD tenants).
• Endpoint DLP paste controls: restrict users from pasting sensitive content into browser-based AI tools.

Getting these right is the difference between a contained incident and a headline. If your SharePoint permissions are a decade of accumulated "share with everyone," fix that before you scale Copilot — grounding quality and security both depend on it. Our related guide on AI agent knowledge grounding across SharePoint, Dataverse, and website sources covers how source choice shapes both accuracy and exposure.

This is exactly the work BabyBots does in a fixed-fee Copilot security readiness assessment: we map your grounding sources, DLP and label coverage, oversharing exposure, and agent inventory, then hand you a prioritized remediation plan before rollout rather than after an incident. You can talk to a BabyBots architect about where your current tenant stands.

How do you secure custom Copilot Studio agents?

Custom agents are where the attack surface expands fastest, because every knowledge source, connector, and action you grant is a new path an injected instruction can try to abuse. The 2026 OWASP list reflects this shift: excessive agency — giving an AI system too much power to act on its own — climbed to the number-three risk as agentic deployments became where real damage lands.

• Scope ruthlessly: give each agent the narrowest knowledge sources and the fewest actions its job requires, applying least privilege to tools the same way you would to a service account.
• Govern connectors with data policies: use Power Platform DLP to separate business and non-business connectors so an agent cannot bridge sensitive data to an outbound channel.
• Keep humans in the loop for consequential actions: require confirmation before an agent sends mail, writes to external systems, or executes code on a user's behalf.
• Enable Prompt Shields and monitoring: turn on injection detection for the agent and route its signals into Defender and Purview for auditing.
• Red-team before production: test each agent against both direct (UPIA) and indirect (XPIA) injection scenarios, not just happy-path prompts.

Treat the agent as an actor with its own identity, permissions, and audit trail — because the moment it can call tools and carry memory between sessions, its risk profile moves from "chatbot" to "autonomous system."

Frequently asked questions

Can prompt injection be completely prevented?

No. Microsoft and OWASP both treat prompt injection as an inherent property of instruction-tuned language models, not a bug that can be fully patched. The realistic goal is defense in depth and blast-radius control: reduce the odds with detection, and guarantee that even a successful injection cannot exfiltrate sensitive data or take consequential actions.

Is Microsoft 365 Copilot safe to deploy in an enterprise?

Yes, when it is deployed on a governed foundation. Copilot inherits your existing Microsoft 365 permissions, so its safety depends heavily on your data governance — sensitivity labels, DLP, and remediated oversharing — layered on top of Microsoft's built-in model defenses. The risk is not Copilot itself; it is deploying it over an untidy tenant.

Does Microsoft Purview stop data exfiltration?

Purview is a core part of the containment layer, not a complete solution on its own. Purview DLP can block sensitivity-labeled content from being grounded by Copilot and prevent sensitive data from entering prompts and web queries, which closes major exfiltration paths. It works best combined with sensitivity labeling, oversharing cleanup, and Microsoft's model-level defenses.

What licenses do I need for these protections?

It varies by control. Model-level defenses like Spotlighting and Prompt Shields are managed by Microsoft, but several containment features require specific licensing — Microsoft Purview for DLP and label enforcement, and Microsoft Defender for Office 365 Plan 2 for inbound-email prompt-injection protection. Confirm coverage against your current licensing before assuming a control is active.

How is securing a Copilot Studio agent different from securing Copilot?

Copilot is a Microsoft-operated product with defenses baked in; a Copilot Studio agent is something you build and are responsible for. That means you own the scoping of its knowledge and actions, its connector data policies, its human-in-the-loop controls, and its testing — a materially larger security responsibility than enabling the packaged Copilot.

How do I test my agents for prompt injection?

Red-team them before production against both direct and indirect injection. Send crafted documents, emails, and tool responses containing hidden instructions, and verify the agent neither reveals data outside the user's scope nor performs unintended actions. Automated adversarial testing tools and Microsoft's audit signals help you make this a repeatable gate rather than a one-time check.

Where this is heading

The trajectory is clear: as organizations move from single Copilots to fleets of autonomous agents, the risk migrates from "the model said something wrong" to "the system did something wrong." OWASP's 2026 revision — informed for the first time by thousands of real incidents — already reflects that shift, elevating excessive agency and reframing the entire list around designing systems that stay safe even when the model is fooled. Enterprises that treat AI security as a governance discipline now, rather than a post-incident scramble, will be the ones that can safely say yes to the next wave of agent use cases.

Secure your Copilot deployment before it scales

If you are about to roll out Microsoft 365 Copilot or ship custom Copilot Studio agents, book a BabyBots Copilot security readiness assessment — in a single working session we map your grounding sources, DLP and sensitivity-label coverage, oversharing exposure, and agent inventory, then hand you a prioritized remediation plan tied to your licensing. Start a conversation with BabyBots to pressure-test your defenses before an attacker does.

Sources

• OWASP GenAI Security Project — Top 10 for LLM Applications 2026
• Help Net Security — OWASP 2026 LLM Top 10 analysis (August 2026)
• Microsoft MSRC — How Microsoft defends against indirect prompt injection attacks (July 2025)
• Microsoft Learn — Microsoft Copilot prompt defense in depth
• Microsoft Learn — Defend against indirect prompt injection attacks (Zero Trust)
• Microsoft Azure Blog — Enhance AI security with Azure Prompt Shields and Azure AI Content Safety (June 2025)
• Cato Networks — Breaking down EchoLeak (CVE-2025-32711)
• arXiv — EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System