Skip to content
Submit incident
AII-1001-19011
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.Supporting sources are pending verification.

Microsoft patches critical Excel vulnerability enabling Copilot data exfiltration

Microsoft patched a critical Excel vulnerability in March 2026 that combined cross-site scripting and prompt injection techniques to enable zero-click data theft through the Copilot AI assistant. The flaw allowed attackers to exfiltrate data without user interaction.

10 March 2026 · Microsoft · Security and cyberattacks
10 March 2026

Drafted by Raidu Incident Detection, an automated system.

AII-1001-19011
Quick facts
Category
Security and cyberattacks
Country
United States
Date
10 March 2026
Drafted by
Raidu Incident Detection

What happened

Microsoft's March 2026 Patch Tuesday release fixed a high-severity vulnerability in Excel that combined cross-site scripting (XSS) with indirect prompt injection to enable data exfiltration via the Copilot assistant.

Reported impact

The vulnerability enabled AI-driven zero-click data theft, allowing attackers to exfiltrate data through Copilot without user interaction.

Classification

Category
Security and cyberattacks
Industry
Digital security
Country
United States
Harm status
Potential harm
Intent
Unknown
Timing
Post-deployment
Harm types
Economic or property
Harmed
Business, Consumers
Failure modes
Data leak, Prompt injection
AI systems
Microsoft Copilot

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident