Microsoft 365 Copilot adds a trust boundary for untrusted content

Prompt injection crosses an authorised path

Microsoft has outlined a new enforcement layer for Microsoft 365 Copilot designed to reduce indirect prompt-injection attacks. Published on 13 October, the approach focuses on malicious instructions hidden inside material that Copilot is legitimately allowed to retrieve, such as an external email or document. Existing identity and access controls can work correctly while the model still mistakes embedded text for an instruction.

That makes indirect injection different from a conventional permissions failure. The user may be authorised to read the message, and Copilot may be authorised to summarise it. The danger appears at inference time, when system instructions, the user’s request and retrieved data enter a shared token stream. An attacker tries to make content behave like a command even though it should be treated only as evidence.

A deterministic layer before the primary model

Microsoft’s design inserts a trust boundary between retrieved tool output and the primary large language model. Deterministic signals classify content as trusted or untrusted. An email arriving from outside the organisation, for example, can be marked untrusted according to tenant policy. The classification does not depend entirely on a probabilistic detector deciding whether the text looks malicious.

Untrusted material is routed through a quarantined and capability-constrained path. That component processes the material in the context of the user’s request and produces a transformed representation intended to retain useful information while dropping malicious instructions. The primary model receives that constrained representation instead of the raw untrusted content.

Provenance remains part of the answer

The system can attach provenance markers so downstream reasoning knows that information originated in an untrusted source. Safer synthesis then combines trusted material, which may pass through unchanged, with structured representations of untrusted material. The aim is to lower the fidelity and control surface available to an attacker without making the external content entirely unusable.

Provenance is valuable because risk does not disappear after transformation. A generated summary may still contain a false claim supplied by an external sender even if executable instructions have been removed. Copilot can use origin information to qualify its answer, and a user can decide whether to open the source or verify the claim through a trusted channel.

Defence in depth, not a universal filter

Microsoft presents the enforcement layer as an addition to classifier-based filtering, sanitisation and hardened system prompts. No single technique detects every wording or encoding of an attack, and point fixes may regress when adversaries alter a pattern. A structural boundary can apply the same constrained flow whenever a policy identifies the source as untrusted, whether or not the text matches a known malicious signature.

The design still depends on correct classification and a safe transformation step. Internal content can be compromised, and legitimate external material may lose important detail when compressed. Organisations should test both security and utility: how often attacks are contained, how much benign information survives, and whether users understand when a response relies on transformed material.

Rollout begins with high-risk content

Microsoft says initial investment targets high-risk sources including external communications, with broader content coverage and deeper integration with policy signals under consideration. Tenant administrators can configure the relevant Outlook sender setting associated with the announced protection and should consult Microsoft’s guidance for CVE-2026-55145. Availability and behaviour may differ by release status and environment.

The change is a useful acknowledgement that enterprise AI needs an inference-time security model in addition to identity and data governance. Trust-aware controls cannot eliminate prompt injection, but they can prevent every retrieved token from arriving with equal influence. For Copilot customers, the practical next step is to map content origins, configure the available signals and evaluate the feature against realistic malicious and benign emails before relying on it at scale.

How organisations can validate the boundary

Security teams can build a test corpus of external messages containing visible instructions, hidden text, encoded commands and benign content that resembles an attack. They should measure whether the trust signal is applied, what the constrained path preserves and whether the primary model follows any planted instruction. Testing should include legitimate newsletters, invoices and support messages so the control does not achieve security by making useful external content unreadable.

Results should be reviewed alongside audit logs and tenant policy. A user-facing indication that content was transformed can help explain a cautious answer, while security telemetry can support investigation. Because attackers will adapt, the corpus needs regular renewal. Deterministic routing provides a stable enforcement point, but the transformation, source policy and downstream model still require continuous evaluation.

The approach may also provide a model for third-party Copilot agents. Tool outputs from external systems can be assigned provenance and processed according to origin before entering a powerful model context. Developers should avoid assuming that every connector supplies trustworthy data simply because an administrator installed it. Explicit trust labels, constrained tools and structured hand-offs can preserve the same principle beyond email and Microsoft-managed content.