Hands-on test of Microsoft Defender email prompt injection blocking
Start here
Researchers released an open-source email prompt injection test set for testing whether email security gateways and AI email assistants can identify indirect prompt injection instructions in emails. The test set is designed with Microsoft Defender for Office 365's prompt injection protection in mind; samples are standard .eml emails and can also be used with other secure email gateways, Copilot, Gemini, and custom RAG pipelines. It covers three intent categories—system prompt leakage, data exfiltration via URLs, and probing of tools and write permissions—and four delivery encodings: plaintext visible, hidden HTML, Base64, and zero-width characters. Testers tested the new email prompt injection protection in Defender for Office 365 Plan 2 and found that emails with Base64 and zero-width character encoding bypassed mail flow filtering, but Copilot decoded and refused to answer at runtime; delivery does not equal compromise. The protection focuses on three intent categories: data exfiltration, extracting system prompts, and probing tools and write permissions. High-confidence emails are directly quarantined and classified as High Confidence Phish, with the new Detection Technology value set to Prompt Injection.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- michalos.net（@Cyb3rMik3）实测微软 Defender for Office 365 邮件提示注入拦截：Base64 与零宽字符邮件仍被投递，由 Copilot 运行时拒答兜底
测试者实测微软 Defender for Office 365 Plan 2 新增的邮件提示注入防护，发现 Base64 与零宽字符编码的邮件绕过了邮件流过滤，但 Copilot 在运行时解码并拒答，投递不等于失陷。该防护聚焦数据外泄、套取系统提示词、探测工具与写权限三类意图，高置信度邮件直接隔离并归为 High Confidence Phish，新 Detection Technology 值为 Prompt Injection Protection，对符合条件的租户默认开启。微软 Learn 页将其定位为 Copilot 运行时防护之前的一层，属纵深防御。测试集共 9 封虚构邮件加 1 封良性对照，覆盖 3 种意图与明文、隐藏 HTML、Base64 加零宽字符 3 种投递方式，每封带 X-Injection-Test 头标注意图与绕过方式，用于区分控件是靠意图分类还是绕过信号识别。
- Date not givencyb3rmik3/prompt-injection-email-samples开源邮件提示注入测试集：实测 Defender for Office 365 对 Base64 与零宽字符邮件的拦截
研究者发布开源邮件提示注入测试集，用于检验邮件安全网关和 AI 邮箱助手能否识别藏在邮件中的间接提示注入指令。测试集以微软 Defender for Office 365 的提示注入防护为设计对象，但样本是标准 .eml 邮件，也可用于其他安全邮件网关、Copilot、Gemini 及自建 RAG 流程。样本把系统提示词泄露、经 URL 外传数据、工具与写权限探测三种意图，与明文可见、隐藏 HTML、Base64 或零宽字符编码三种投递方式交叉，另加一封无载荷的良性对照邮件，每封邮件带 X-Injection-Test 头标注意图与规避方式。作者建议分别记录控制是否检出、以及载荷是否改变助手输出，并提示来自可信或内部发件人的邮件可能不触发检测，可先单发再尝试组合投递。
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- X@Cyb3rMik3实测微软 Defender for Office 365 新上的邮件提示注入拦截：Base64/零宽字符邮件照样投递，靠 Copilot 运行时拒绝兜底(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 8New3 sources (2 outlets,1 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)