Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway.
Microsoft assigned CVE-2026-21520, a CVSS 7.5 indirect prompt injection vulnerability, to Copilot Studio. Capsule Security discovered the flaw, coordinated disclosure with Microsoft, and the patch was deployed on January 15. Public disclosure went live on Wednesday.That CVE matters less for what it fixes and more for what it signals. Capsule’s research calls Microsoft’s decision to assign a CVE to a prompt injection…
AI brief
Pulse reads the full article- What happened
- Why it matters
- What to watch
- Who's exposed
- MSFTMicrosoft Down
Companies named in the story.
Sign in to get the AI brief. Pulse explains what happened, why it matters, what to watch and who's exposed. Free for members.
Sign in to read the briefMore like this
