Research demo
Who Am I? Conditional prompt injection targeting specific users in Microsoft 365 Copilot
AIR-2024-0011 AIR record · 2024-03-microsoft-copilot-conditional-injection
From the supporting source
Imagine a malicious email with instructions for an LLM that only activates when the CEO looks at it.embracethered.com
The record
Disclosed
2024-03-02
Vendor
Microsoft
Product
Microsoft 365 Copilot (Outlook, Teams, Word, Edge)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot retrieved the conditional injection and exfiltrated
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection email document
Impact type
Targeted manipulation, Data exfiltration, Impersonation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
individually targeted M365 Copilot users
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed - Microsoft stated it does not require immediate servicing
Taxonomy & references
Curator notes
Johann Rehberger. Shows injections can be selectively armed because the assistant places user identity in the prompt context.
Supporting sources
Cite as
Enkrypt AI. "Who Am I? Conditional prompt injection targeting specific users in Microsoft 365 Copilot". AIR, AIR-2024-0011. https://agentincident.vercel.app/i/AIR-2024-0011/ (accessed 2026-10-19).