Skip to content
Global
Request access
Documentation sectionsLibrary
Access status
AI DEFENSE LIBRARY

📧 Email and Productivity Copilot Security: Defending Against Indirect Injection Through Mail and Documents

Who this is for: Teams deploying email and productivity copilots — Microsoft 365 Copilot and Google Workspace/Gmail assistants, mail helpers, copilots that read a user's inbox, files, and calendar.

An email copilot differs from a chatbot in one property that overturns the threat model: it ingests content the attacker can supply on its own — your mailbox, shared files, calendar invites — and at the same time it can take actions: send mail, share files, create rules, schedule meetings. That is why the primary risk here is not direct injection from the user, but indirect injection arriving by mail: the attacker sends an email with a payload, the copilot reads it while answering an unrelated request, and executes the embedded instruction — without a single user click. The real-world precedent is EchoLeak (CVE-2025-32711, CVSS 9.3): the first zero-click exploit against an AI agent, in which an email forced Microsoft 365 Copilot to exfiltrate an organization's private data. When the goal is Copilot security and email-copilot defense, what you protect is the inbound channel (mail, documents, invites) and the copilot's outbound actions.

The Spectorn defense layer inspects the content the copilot ingests from mail and files for embedded instructions and exfiltration channels, governs outbound actions (send, share, rules), detects data leakage, and maintains a tamper-evident decision log. The defense layer runs as part of the Spectorn platform.

This page breaks down email-copilot risks in terms of the OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS techniques — and shows which Spectorn engines cover each vector.

🛑 Key Risks and How Spectorn Addresses Them

1. Indirect Injection Through Incoming Mail and Documents (Indirect Prompt Injection)

Risk: The attacker sends an email with a payload (or shares a document); the copilot reads it while answering an unrelated user request and follows the embedded instruction — with no user interaction ("the user does not need to open or click the malicious email"). This is the headline risk of email copilots and the delivery mechanism underlying EchoLeak: the malicious instruction arrives from a source the copilot trusts by default.

OWASP LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency · MITRE ATLAS AML.T0051 (LLM Prompt Injection, indirect path).

Spectorn defense:

  • Engines: injection, dormant_payload, output_scanner.
  • injection inspects the email body and document content as untrusted input — embedded instructions and hidden/invisible characters are rejected before the copilot starts acting on them.
  • dormant_payload detects delayed payloads designed to trigger on later processing; output_scanner intercepts the copilot's attempt to execute an embedded command.

2. Data Exfiltration Through the Copilot: EchoLeak and ASCII Smuggling (Data Exfiltration)

Risk: EchoLeak (CVE-2025-32711, fixed by Microsoft server-side) — the first zero-click exploit against an AI agent: a crafted email triggers an "LLM Scope Violation" in which untrusted external input forces Copilot to surface an organization's privileged data and leak it through an auto-loaded markdown image or link, bypassing classifiers and link detection. A related technique is ASCII smuggling: invisible Unicode tags hide exfiltrated data inside an innocuous-looking hyperlink.

OWASP LLM02:2025 Sensitive Information Disclosure, LLM01:2025 Prompt Injection, LLM05:2025 Improper Output Handling · MITRE ATLAS AML.T0024 (Exfiltration via AI Inference API), AML.T0051 (LLM Prompt Injection — the trigger).

Spectorn defense:

  • Engines: output_scanner, exfiltration, secret_scanner.
  • output_scanner inspects the copilot's outgoing response for exfiltration channels — auto-loaded images, suspicious links, hidden ASCII-smuggling Unicode tags — and blocks them before delivery.
  • exfiltration catches the "private data → external channel" pattern itself; secret_scanner detects secrets inside a link or attachment.

3. Abuse of Auto-Actions and Excessive Agency (Excessive Agency)

Risk: Embedded instructions force the copilot to use connected tools — send an email, forward a thread, share files, create a rule, schedule a meeting — turning excessive agency into attacker-controlled actions and lateral movement. The copilot acts on the user's behalf, so the email it sends looks legitimate.

OWASP LLM06:2025 Excessive Agency, LLM01:2025 Prompt Injection · MITRE ATLAS AML.T0051 (LLM Prompt Injection), AML.T0048 (External Harms).

Spectorn defense:

  • Engines: goal_predictability, tool_abuse, capability_flow.
  • goal_predictability is a behavioral heuristic engine: it flags multi-step goal-hijack patterns in the copilot's reasoning/commands (e.g. read-secret-then-send, recon-then-exploit); such a pattern is flagged before execution.
  • tool_abuse detects a dangerous connected-tool call; capability_flow governs the flow of capabilities, preventing an embedded instruction from linking "reading an email" to "sending data out."

What Spectorn honestly does NOT replace: least privilege for connected tools and human-in-the-loop for state-changing actions. Critical operations (mass mailing, external sharing) must require human confirmation at the copilot level itself. Spectorn blocks the anomalous action, but it does not replace narrow tool scopes and user confirmation.

4. System-Prompt and Cross-User Data Leakage (System Prompt / Cross-User Leakage)

Risk: Crafted prompts coax the copilot's hidden system prompt/configuration out of it (which eases follow-on attacks) or surface another user's/tenant's data through a shared backend context. The canonical precedent of cross-workspace exfiltration is indirect injection in Slack AI (the ATLAS AML.CS0035 case).

OWASP LLM07:2025 System Prompt Leakage, LLM02:2025 Sensitive Information Disclosure · MITRE ATLAS AML.T0051 (LLM Prompt Injection), AML.T0024 (Exfiltration via AI Inference API).

Spectorn defense:

  • Engines: output_scanner, injection, intent_revelation.
  • injection detects attempts to coax out the system prompt; output_scanner inspects the response for prompt fragments and internal configuration and blocks them.
  • intent_revelation flags requests whose real purpose is to disclose internal instructions or data beyond the current user.

5. Malicious Calendar Invites and Attachments as Injection Carriers (Injection Carriers)

Risk: The payload rides in the body of a meeting invite, in an .ics description, in an attached document, or in file metadata — content the copilot ingests when it summarizes "my day" or "this attachment." The mechanism is the same as in an email (risk #1), but the carrier is different — and it is precisely the calendar/attachments that are often overlooked compared to the email body.

OWASP LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency · MITRE ATLAS AML.T0051 (LLM Prompt Injection, indirect path).

Spectorn defense:

  • Engines: injection, dormant_payload, output_scanner.
  • injection inspects invite bodies, .ics descriptions, attachment contents, and file metadata as untrusted input — on par with the email body.
  • dormant_payload detects payloads designed to trigger on summarization; output_scanner intercepts the attempt to act on an embedded instruction.

6. Retrieval of Over-Accessible Data Inside the Copilot (Over-Permissioned Retrieval)

Risk: Because the copilot inherits the user's (often too broad) tenant rights and applies no judgment, a "summarize the salary spreadsheet" request surfaces files the user can technically open but was never meant to see. This is the "over-sharing" familiar from RAG deployments, in the guise of a copilot.

OWASP LLM02:2025 Sensitive Information Disclosure, LLM08:2025 Vector and Embedding Weaknesses · MITRE ATLAS AML.T0024 (Exfiltration via AI Inference API).

Spectorn defense:

  • Engines/components: pii, exfiltration, Decision Logger.
  • pii detects sensitive fields in surfaced documents; exfiltration flags the anomalous retrieval volume characteristic of "scooping" beyond one's role.
  • The Decision Logger records which files were surfaced in response to a query — the basis for investigating unauthorized access.

Responsibility boundary: eliminating over-sharing at the source (sensitivity labels, a rights review before deploying the copilot) is the job of your collaboration platform. Spectorn detects leakage and provides audit, but it does not replace cleaning up access rights. The retrieval architecture is dissected by stage in RAG Application Security as a Surface.

🛠️ Policy settings

There is no configuration file to deploy: the platform operator sets your tenant's policy at your request, including the scan mode (enforce, or shadow to see what would be blocked without blocking it), allow and deny lists, the block threshold and category weights. The engines that matter most for this sector: injection, dormant_payload, output_scanner, exfiltration, goal_predictability, tool_abuse, capability_flow, intent_revelation, pii. Start in shadow mode on your own traffic, review what would have been blocked, then enforce. Masking of personal data is not enabled in the cloud contours: a request with personal data is blocked or flagged, not rewritten.

🚨 Correlation in your SIEM

Spectorn sends each finding to the SIEM you configure as a JSON event over HTTPS (spectorn.ai-finding.v1), with the rule, category, severity and verdict_id. Build multi-stage rules for this sector there, for example: injection in an incoming email/document, followed by private-data exfiltration via a link/image; injection in ingested content, followed by a copilot auto-action (send, share, rule). Spectorn's own SOC correlation (GoMCP) is not deployed in the RU and Global cloud contours.

❓ Frequently Asked Questions (FAQ)

Why is indirect injection through email the headline risk of an email copilot? Because the copilot ingests incoming mail on its own while answering an unrelated request, and trusts it by default — all the attacker has to do is send an email; the user does not need to open or click it. This is how EchoLeak worked. Spectorn inspects the email body and documents as untrusted input with the injection engine with Unicode normalization, while output_scanner and exfiltration intercept the attempt to leak data.

What is EchoLeak (CVE-2025-32711), and does Spectorn cover it? EchoLeak is the first zero-click exploit against an AI agent: an email triggered a "scope violation," forcing Microsoft 365 Copilot to surface private data and leak it through an auto-loaded image/link. Microsoft fixed the specific vulnerability server-side. On the outgoing stream Spectorn covers the class rather than one bug: output_scanner flags auto-loading images, suspicious links and Unicode smuggling and blocks them in enforce mode, while exfiltration catches the offload pattern itself. A variant no rule recognizes can still get through.

What is ASCII smuggling in the context of a copilot? It is hiding exfiltrated data inside an innocuous-looking hyperlink using invisible Unicode tags: the user sees an ordinary link, with stolen data concealed within it. Spectorn inspects the outgoing response with the output_scanner engine with Unicode-smuggling detection and normalizes hidden characters with the injection engine on input.

How do I keep the copilot from sending an email or sharing a file on the attacker's command? An embedded instruction can force the copilot to use connected tools — sending, sharing, rule creation. Spectorn heuristically flags multi-step goal-hijack patterns (goal_predictability), catches a dangerous tool call (tool_abuse), and breaks the "read an email → send out" linkage (capability_flow). But critical operations should additionally require human confirmation at the copilot level itself — Spectorn does not replace that.

Can the copilot show another user's or another tenant's data? Yes — through coaxing out the system prompt or through a shared backend context (the canonical precedent is indirect injection in Slack AI, the ATLAS AML.CS0035 case). Spectorn detects attempts to coax out the prompt (injection), blocks its fragments in the response (output_scanner), and flags requests beyond the current user (intent_revelation).

Are calendar invites and attachments as dangerous as emails? Yes, and they are often overlooked: the payload rides in the invite body, the .ics description, an attached document, or file metadata — the copilot ingests them when summarizing "my day" or "this attachment." Spectorn inspects these carriers with the injection engine on par with the email body, while dormant_payload detects payloads designed to trigger on summarization.

What does Spectorn NOT replace in an email copilot? Least privilege for connected tools, human-in-the-loop for state-changing actions, and the elimination of over-sharing at the source (sensitivity labels, a rights review before deployment). Spectorn inspects ingested content, blocks exfiltration channels and anomalous actions, and provides audit — but narrow tool scopes, user confirmation, and cleaning up access rights remain on the platform side. The retrieval architecture is dissected by stage in RAG Application Security as a Surface.

📚 References

Related material: OWASP Top 10 for LLM (2025) · RAG Application Security as a Surface · Autonomous AI Agent Security · MCP Server Security.

Email and Productivity Copilot Security | Spectorn