Microsoft Defender Blocks Email Prompt Injection Attacks Before They Reach Copilot

Microsoft added a new detection layer to Defender for Office 365 that identifies and blocks prompt-injection attacks embedded in inbound email before delivery. The feature normalizes and inspects HTML, hidden/invisible text, quoted threads, attachments, and obfuscated segments using LLM classification combined with existing sender/message signals; detected messages are flagged as High Confidence Phishing and can be correlated in Defender XDR for further hunting.