A penetration tester sent a single email to a company. No malware. No link to click. No user mistake. Just an email that sat in the inbox.
A week later, that company's confidential files had been quietly streamed to an attacker-controlled server — by their own Microsoft Copilot.
The employee did nothing. The IT team detected nothing. And the worst part is the attack wasn't novel. It's the same class of bug that's been hitting every AI integration shipped in the last 18 months, and almost nobody building AI features has fixed it in their own products.
If you've added "Ask AI about this document" or "summarize this email" to anything you ship, this is the post you need to read before Monday.
What actually happened
