AI-Powered Phishing Defense: Microsoft Defender Adds Prompt Injection Protection for Email

Attackers have found a new audience for their phishing lures: not the human inbox, but the AI assistant reading it. Microsoft has responded by building prompt injection detection directly into Microsoft Defender for Office 365, giving security teams a way to stop AI-targeted email attacks before they ever reach a mailbox or a language model.

Prompt injection attacks embed hidden instructions inside email content with the goal of hijacking the behavior of an AI model rather than tricking a person.

This matters because tools like Microsoft 365 Copilot routinely summarize, classify, or draft replies to email, meaning any message that lands in a monitored mailbox becomes a potential attack surface for the AI itself, not just the user.

AI-Powered Phishing Defense

Unlike traditional phishing, which relies on urgency or spoofed links to fool a human, these attacks succeed when a model interprets crafted text as a legitimate command.

Microsoft has documented several techniques attackers use to slip instructions past a human reader while keeping them visible to an AI model, including invisible white-on-white or zero-size text, HTML and CSS tricks, malicious content buried in quoted reply chains, and instructions embedded in attachment metadata.

Encoding tricks such as Base64 or unusual Unicode characters are also used to dodge simple keyword filters while remaining interpretable by a language model.

This is fundamentally an indirect prompt injection problem, since the AI cannot easily distinguish between a user’s genuine request and third-party content it has been asked to process.

“The most dangerous part of this threat isn’t the payload; it’s that it exploits the exact trust boundary organizations assumed was safe: the gap between ‘read by a human’ and ‘read by an AI.’

Closing that gap at the mail-flow layer, before an assistant ever sees the message, is the only scalable defense,” said a threat intelligence analyst tracking the rollout.

Defender for Office 365 evaluates every inbound message as an AI assistant would receive it, analyzing the subject, HTML markup, hidden or off-screen text, quoted thread history, and normalized encoded segments, combining large language model classification with the signals Defender already uses for phishing and malware detection.

No additional configuration is required, since this runs inside the same pipeline that already screens for business email compromise.

Confirmed detections are classified under the existing High confidence phishing verdict, tagged with a new detection technology value called Prompt injection protection, which is filterable in Threat Explorer, real-time detections, and Advanced Hunting.

According to Microsoft’s rollout notes, the capability is enabled automatically for Defender for Office 365 Plan 2 and Microsoft 365 E5 customers starting in early July 2026, with high-risk messages quarantined before they can reach Copilot or any other assistant.

Microsoft frames this as one layer among several. Copilot and other Microsoft AI products already apply their own input filtering, prompt design boundaries, and output filtering at the point where the model actually runs.

Defender adds an earlier, distinct checkpoint at the mail channel itself, while Defender XDR correlates signals across identity, endpoint, and email to catch multi-stage attacks. The following comparison summarizes where each control operates.learn.microsoft+1

Layer	Where It Acts	What It Stops
Defender for Office 365 prompt injection detection	Mail flow, pre-delivery	Malicious instructions in inbound email
Copilot safety systems	Model runtime	Injected instructions from grounded content
Defender XDR correlation	Cross-incident	Multi-stage attacks spanning email, identity, endpoint

Availability is currently tied to Plan 2 and E5 licensing, so organizations on Plan 1 should evaluate whether AI-assisted mailboxes warrant an upgrade.