Microsoft Copilot Security Research: Prompt-Injection Phishing Risk and Copilot Studio Audit-Logging Gaps

Security researchers reported two distinct Microsoft Copilot-related risks: (1) cross prompt injection against Microsoft Copilot email summarization surfaces that can cause attacker-supplied text in an email to be treated like instructions, shaping the summary into a convincing in-product “security alert” and creating a phishing path that does not rely on attachments or macros; and (2) audit-logging gaps in Microsoft Copilot Studio where certain administrative actions for Copilot Studio agents (e.g., around sharing, authentication, logging, and publication) were not consistently recorded in Microsoft 365’s Unified Audit Log, potentially reducing defenders’ ability to detect malicious or unauthorized agent changes.

Permiso described how Copilot’s behavior varies across Outlook’s inline Summarize experience, the Outlook Copilot pane/add-in, and Teams-based summarization, with the core risk being trust transfer—users may treat Copilot output as system-generated even when it is attacker-influenced—and warned that retrieval across Microsoft 365 (Teams/OneDrive/SharePoint) could amplify impact if chained. Datadog Security Labs stated it reported Copilot Studio logging issues to MSRC, that Microsoft remediated logging for the affected events by October 5, 2025, and that Datadog later observed a regression where some events again failed to log consistently, which it also reported to Microsoft.