Can an Outside Email Tell Your Copilot What to Do?
Updated: 18 hours ago
Short answer: It can try. Someone outside your firm can hide instructions inside an ordinary-looking email, and when Copilot reads or summarizes your inbox it may treat that text as something to act on. This is called prompt injection. Microsoft has released a mitigation for this in Outlook Copilot (CVE-2026-55145), but it depends on a setting your administrator has to turn on: Outlook's external sender tag. For firms that want to go further, Microsoft Purview DLP has a preview control that keeps outside email out of Copilot entirely.
Law firms, RIAs and other professional firms get a lot of email from people they don't know. If staff now ask Copilot "what's important in my inbox today?", it's worth knowing which of those emails Copilot is allowed to read and trust.
What is prompt injection in email?
Copilot works by reading content, such as your emails, files and chats, and answering in plain language. Prompt injection is when someone plants text in that content that's written as an instruction instead of information. In an email it might be hidden in small or white text, or tucked below a signature. A person reading the email skims past it. An AI assistant reading the whole message may not.
The goal can be to change what Copilot tells you, for example by making an outside message look urgent or trustworthy in a summary, or by nudging a drafted reply.
Is this a real risk for Microsoft 365 Copilot?
Yes. Microsoft published CVE-2026-55145, an "Outlook Copilot Tampering Vulnerability," with its July 14, 2026 security updates. Microsoft marks it as requiring customer action. Its guidance: "Customers can help protect themselves by enabling Outlook's external sender tagging feature to identify untrusted content. This enables Microsoft's provided mitigations to isolate and safely process the untrusted content before it is provided to Microsoft 365 Copilot." (Microsoft Security Response Center)
In other words, the fix isn't fully automatic. If your tenant never turned on the external tag, that mitigation may not be working for you.
What is the Outlook external sender tag?
It's a tenant-wide Exchange Online setting that marks email from outside your organization with an "External" label in Outlook. Many firms already use it as a phishing cue for staff. Now it does a second job: it tells Microsoft which messages are untrusted so they can be handled separately before Copilot uses them.
Your administrator turns it on in Exchange Online PowerShell. Get-ExternalInOutlook shows the current setting, and Set-ExternalInOutlook -Enabled $true turns it on. If your firm uses an older mail-flow rule that adds "[EXTERNAL]" to subject lines, review it so staff don't see double tags.
Can we stop Copilot from reading outside email altogether?
Yes, with a preview feature in Microsoft Purview Data Loss Prevention. A DLP policy using the Microsoft 365 Copilot and Copilot Chat location, with the condition Email is received from > External users and the action Prevent Copilot from processing content, tells Copilot to exclude outside email from grounding, summarization and citation. Staff can still open and read those emails normally. Microsoft says this helps "reduce the risk of prompt injection and untrusted data influence." (Microsoft Learn)
Some details from Microsoft's documentation worth knowing before you turn it on:
It's in preview, so test it before relying on it.
It checks the sender's domain against your accepted domains. It does not read the email body.
The Copilot location is only available in the Custom policy template, and a policy using it can't cover other locations.
Policy changes can take up to four hours to show up in Copilot.
Licensing depends on your Microsoft 365 plan.
Which setting should a small firm use?
For most firms, start with the external sender tag. It's the step Microsoft names for CVE-2026-55145, and it helps staff spot outside mail too.
Consider the Purview DLP control if your firm handles a lot of unsolicited outside email and wants Copilot to work only from internal content. The trade-off is that Copilot won't summarize client or counterparty emails at all, which may not suit how your team works. Law firms and RIAs often decide case by case, and some pilot the policy with a small group first.
What should owners do this week?
Ask your IT provider or admin whether the Outlook external sender tag is on. Ask them to confirm it in Exchange Online, not just from memory.
Turn it on if it isn't, and retire any duplicate "[EXTERNAL]" subject-line rule.
Decide on the Purview DLP preview. If you want outside mail kept out of Copilot, pilot the policy with a few users and note what changes for them.
Remind staff that a Copilot summary is a starting point. Before acting on a payment change, a deadline, or a request to share files, open the original email and verify it another way, such as calling a known number.
Write it down. Record which settings you chose and when. For RIAs, that kind of record helps when an examiner asks how you manage AI tools (what SEC examiners ask your IT provider).
Prompt injection sits alongside other inbox tricks that get past the usual defenses, like device code phishing. The same habit helps with all of them: slow down and verify before you act.
How does 24uNet help?
24uNet reviews Microsoft 365 settings like these as part of our Security Baseline, and we help law firms and financial services firms roll out Copilot with sensible guardrails. Email protection is part of how we secure your network. Our approach is built to support the documentation your clients, insurers and regulators expect.
FAQ
Can an email really change what Copilot tells me?
It can try. Hidden text in an email can be written as an instruction to an AI assistant. Microsoft released a mitigation in Outlook Copilot (CVE-2026-55145) that relies on the Outlook external sender tag being turned on.
Is the Outlook external sender tag on by default?
Don't assume it is. It's a tenant-wide Exchange Online setting your administrator controls. Ask them to check it with Get-ExternalInOutlook.
Will blocking external email in Copilot hide those emails from staff?
No. The Purview DLP control stops Copilot from using outside email for summaries and answers. Staff can still open and read the emails in Outlook.
Does the Purview DLP control read the email itself?
No. Microsoft says it checks only the sender's domain against your organization's accepted domains. The email body isn't inspected.
Do we still need staff training if these settings are on?
Yes. Settings reduce the risk, but staff should still verify payment changes, urgent requests and file-sharing requests from the original email and a known contact before acting.
Talk to 24uNet about Copilot and email settings. Call Denver (303) 468-5515 or College Station (979) 256-5100, or email sales@24unet.com.
Related reading: Cybersecurity Technology Solutions for the Top 3 Manufacturing Pain Points; Top 3 Cybersecurity Pain Points in Healthcare and the Technology Solutions That Fix Them.
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments