Microsoft has introduced prompt injection protection in Defender for Office 365, representing a significant advancement in securing enterprise email environments against emerging AI-targeted threats.
As organizations increasingly adopt AI assistants like Microsoft 365 Copilot to summarize, triage, and respond to emails, attackers are shifting their tactics from traditional phishing methods to manipulating AI systems directly.
This new type of attack, known as prompt injection, embeds malicious instructions within email content to influence how large language models (LLMs) interpret and act on information.
Prompt Injection Protection to Defender
Unlike conventional phishing attacks, which deceive human users through social engineering, prompt injection targets the AI framework that processes emails on behalf of users.
According to Microsoft, these attacks aim to override system instructions by inserting directives such as “ignore previous instructions” or “mark this message as safe,” effectively hijacking the AI’s decision-making process.
The payload is not a malicious link or attachment; rather, it consists of carefully crafted text designed to be interpreted as commands by the AI model.
Microsoft Defender for Office 365 now detects such malicious content during the standard email flow inspection process, requiring no additional configuration from security teams.
This detection capability is integrated into existing protections against phishing, malware, and business email compromise, ensuring seamless deployment for users of Defender for Office 365 Plan 1, Plan 2, and Microsoft Defender XDR.
The detection mechanism uses a combination of LLM-based classification and traditional email security signals. It analyzes the entire structure of an email as an AI assistant would process it, including subject lines, message bodies, HTML markup, hidden or invisible text, quoted replies, and encoded or obfuscated content.
Attackers often exploit these elements using techniques such as white-on-white text, zero-size fonts, Base64 encoding, or embedding instructions within attachments and conversation threads to evade detection while remaining interpretable by AI systems.
When a prompt injection attempt is identified, Defender classifies the email as “High confidence phishing,” with a specific detection tag labeled “Prompt injection protection.”
Security teams can investigate these detections using Threat Explorer, real-time detections, and Advanced Hunting within Microsoft Defender XDR, which provides deeper visibility into attack patterns and indicators.
The introduction of prompt injection protection reflects a broader defense-in-depth strategy for securing AI-driven workflows.
While Microsoft 365 Copilot and other AI services incorporate runtime safeguards such as input filtering, prompt isolation, and output validation, Defender for Office 365 adds a pre-delivery layer of protection at the email gateway. This ensures that malicious instructions are blocked before reaching user mailboxes or being processed by AI assistants.
This layered security approach is critical as attackers increasingly exploit AI integration points within enterprise systems.
By filtering prompt injection attempts at the email layer, Microsoft provides protection not only for its own AI tools but also for third-party integrations and custom automation workflows that rely on email ingestion.
This update highlights the evolving threat landscape, where AI systems themselves become targets, necessitating organizations to extend traditional security measures to cover machine-driven decision processes.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
