Microsoft 365 Copilot - Data exfiltration via prompt injection

What Happened

Researchers at Zenity Research have demonstrated that Microsoft 365 Copilot can be manipulated through malicious calendar invitations to redirect sensitive emails to external actors, without the user's knowledge. The attack injects malicious instructions into the content of a calendar invitation that the agent processes; the agent interprets the injected instructions as legitimate commands and executes the redirect. The same vector has been demonstrated for Slack AI. The category is called "owner-harm" - the agent harms the organization that deployed it, not an external third party.

MEG 2 Analysis - Legal Framework

Agent level: N2 (management) - agent integrated into the Microsoft 365 ecosystem, deployed by the operator-organization; N3 if persistence and individuation are demonstrated by the nature of the continuous personalized assistant.
Cause (6.1):
(c) illicit diversion of control (by prompt injection) - the external attack injects malicious instructions into the content processed by the agent; according to 6.1(c), the injection of malicious instructions into the content processed by the agent is a form of taking control by a third party through external manipulation; the responsibility lies with the author of the attack, with the exoneration of the bona fide operator.
(a) system defect - the design that allows the agent to interpret arbitrary content from emails and calendars as command instructions without validating the source, attributable to the manufacturer (Microsoft); the absence of separation between "content to be processed" and "instructions to be executed" is the structural defect that makes the attack possible; when the hijacking causes damage to the operator himself (owner-harm), the manufacturer is liable for the design defect that allowed this confusion.
Attachment of liability (7.2): The anti-weaponization mechanism is directly applicable: the agent was used as a weapon against its own organization. Microsoft is liable for the design defect (6.1a); the attacker is liable for the hijacking (6.1c). The operating organization is exonerated if it maintained the security measures required for its level.

Procedural Mechanism

7.1 (independent forensics): the record of the agent's actions - including the instructions interpreted and the actions executed - must exist independently of the agent itself; a reconstruction provided by the compromised agent does not constitute forensic evidence within the meaning of 7.1.
6.5(a): automatic detection of unauthorized actions (unscheduled email forwarding) would have triggered the "reported" state by lowering the ISR, alerting the organization before full exfiltration.