Copilot, Who Am I? An Email That Gaslights Its Reader Based On Their Name

What happened

A security researcher showed that a malicious email could give Microsoft 365 Copilot different instructions depending on who opened it, using the reader's name. In a test with three participants, Copilot followed the attacker's hidden instructions for each recipient, including denying access to one. Microsoft said the issue did not need immediate servicing.