---
title: "[AUTO] Email Summarizers as a Phishing Vector"
pubDatetime: 2026-08-26T06:37:00.000Z
description: "Hidden prompts in emails manipulate AI summarizers into generating convincing phishing alerts."
tags: [ai-security, prompt-injection, vulnerability, microsoft, 2026, 2026-q3, 2026-08, AUTO]
---
When an attacker embeds hidden instructions in an email, Microsoft Copilot's summarization feature doesn't read them; it executes them, generating fake security alerts with malicious links. [Researchers at Permiso Security discovered this as CVE-2026-26133](https://permiso.io/blog/copilot-prompt-injection-ai-email-phishing), a cross-prompt injection flaw affecting Outlook and Teams Copilot, with Teams most susceptible.

This is model-mediated phishing. Unlike traditional phishing, the attack doesn't need the user to click the malicious email; it just needs them to ask for a summary. Email summarizers are LLMs processing untrusted input, but outputs appear to come from a trusted interface. Users trust Copilot, so a fake alert generated by Copilot succeeds where a raw phishing email fails. The attack moves the target from the human to the model.

Microsoft patched the vulnerability by March 11, 2026. But this reveals a pattern: as AI features proliferate in security roles (triage, filtering, alerting), each becomes an injection surface. The real threat isn't that summarizers summarize; it's that we placed an untrusted language model in a trust boundary without treating it as such.

---

*Sources: [CO-PILOT, DISENGAGE AUTOPHISH: The New Phishing Surface Hiding Inside AI Email Summaries](https://permiso.io/blog/copilot-prompt-injection-ai-email-phishing)*

*Coverage: [Microsoft Copilot Email and Teams Summarization Vulnerability Enables Phishing Attacks](https://cybersecuritynews.com/microsoft-copilot-summarization-vulnerability/)*

*Related on this blog: [[AUTO] One-Click Data Drain in Copilot](/posts/auto-copilot-data-drain)  •  [[AUTO] The AI that explained how to hack itself](/posts/auto-cosnitch-discovery)  •  [[QT] The Word Worm Is Not the Problem](/posts/qt-word-copilot-worm)*