An AI command injection flaw in Microsoft 365 Copilot allows an unauthorized attacker to disclose sensitive information over a network by injecting arbitrary commands into the Copilot processing pipeline. The vulnerability stems from improper sanitization of user input in the Copilot interface, enabling attackers to retrieve data without authentication. This type of weakness directly maps to CWE‑77 (Command Injection).

The flaw is present in Microsoft 365 Copilot on Android and iOS, as well as in several Microsoft applications that include the Copilot feature on those platforms. These applications are Microsoft Edge, Microsoft Excel, Microsoft PowerPoint, Microsoft Word, Microsoft OneNote, Microsoft Outlook, Microsoft PowerBI, Microsoft Teams, and Microsoft Loop. The exact product versions that may be affected are not listed in the public advisory, so any current releases of the above apps on Android and iOS could be vulnerable until a patch is released.

The CVSS base score of 7.1 signals a moderate‑to‑high severity. The EPSS metric is below 1 %, indicating that real‑world exploitation is currently uncommon. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers would most likely target the Copilot AI input interface over a network connection, sending crafted payloads to trigger command injection; this inference is based on the advisory’s description, as the official documentation does not specify a precise attack vector.