What happened
On 23 January 2026 Andi Ahmeti, a researcher at Permiso Security, reported a problem in Microsoft 365 Copilot to Microsoft. An email could make Copilot's summary in Outlook say whatever the sender wanted, in a voice that looked like the system's own. Microsoft rolled out fixes from 17 February and finished on 11 March 2026. The flaw was published as CVE-2026-26133, rated 7.1 out of 10, high. The entry added to the CVE record by the US Cybersecurity and Infrastructure Security Agency lists its exploitation as none.
The email
The attacker's text sat in the body of the email, hidden from people with HTML and CSS tricks. A reader saw an ordinary message. Copilot read everything.
When the user clicked Summarize in Outlook, or asked about the message in the Copilot pane, the summary included a fake security alert marked as requiring action, with a link to follow. It was presented as if Copilot itself had generated it. In one test across Microsoft's apps, Copilot also placed recent context from the user's Teams conversations into a link the attacker controlled. That turns a fake alert into a possible leak.
Why it worked
People have learned to doubt a strange email. They have had far less practice doubting the tool that summarises it. A warning that appears in Copilot's pane, in Copilot's style, borrows Microsoft's authority. It also arrives at the moment the user asked for help, which makes it feel like an answer instead of a message.
Permiso's write-up put it plainly: email summarisation is an adversarial surface, because untrusted text can behave like instructions. The same pattern appeared in Gemini for Google Workspace in 2025. A year later it worked again in a different product.
What it cost
Nothing that is known. The flaw was reported privately and fixed before publication, and no exploitation was recorded. The case is in this archive because it repeats a pattern across vendors. When an assistant reads mail for you, the sender can try to speak through it.
What would have helped
Microsoft's fix closed this path in Copilot. For people, the durable rule is the same as for any alert. A real security warning about your account is visible on the account's own security page. Do not follow a link from a summary of someone else's email. Sign in by typing the address yourself.
What a warning inside the message would have shown. Antilure works in Outlook on the web and desktop through an add-in, and checks each message for text hidden from the reader and aimed at an assistant. When it finds such text, the banner inside the message says it contains hidden instructions aimed at AI assistants, with the advice not to let an assistant act on it.
Sources
- CVE-2026-26133, CVE Program record, Microsoft as numbering authority, published March 2026.
- Permiso Security's write-up of the finding, Andi Ahmeti, Permiso Security, 12 March 2026.