An AI assistant can help an agent summarize a crowded inbox, pull out showing requests, or prepare a follow-up list. The difficult part is that an email is not automatically trustworthy just because it arrived in a mailbox the AI is allowed to read. A message can contain inaccurate details, a suspicious link, or instructions designed to steer the AI away from the task you gave it.

Microsoft’s October 13 Copilot announcement describes a new enforcement layer for indirect prompt injection. Microsoft says external email can be classified as untrusted, processed through a constrained path, transformed before it reaches the primary model, and marked with information about where it came from.

This is a meaningful security improvement, but it is not a universal switch or a promise that every unsafe instruction will be caught. Microsoft says the protection is being introduced, initially focuses on high-risk content including external communications, and can vary by release status and tenant environment. It also tells administrators to enable the applicable Outlook sender setting and review its configuration guidance.

What is indirect prompt injection?

A prompt injection is an instruction placed in content an AI reads. In an email workflow, the agent may ask Copilot to summarize new messages. One message could contain text that tries to make the assistant ignore the user’s request, reveal other information, follow a link, or take an unrelated action. The instruction may be visible, hidden in formatting, or mixed into otherwise normal business content.

The important distinction is that ordinary account permissions can still be working. The AI is allowed to read the email; the danger is that it may confuse data inside the email with instructions from the user. Microsoft’s approach creates a stronger boundary based on the source of the content, then limits how untrusted material reaches the main model.

Why real estate inboxes deserve this boundary

Real estate professionals receive external messages all day: portal inquiries, showing requests, vendor notices, transaction updates, attachments, calendar invitations, and introductions from people they have never met. That makes email useful grounding material for AI—and a poor place to assume every sentence is safe.

The practical risk is not limited to a dramatic data breach. An AI summary might omit a real request, elevate a false deadline, misstate who sent a message, or prepare a task based on embedded instructions. In relationship work, even a smaller error can create confusion: the wrong property in a recap, an unverified wire instruction treated as routine, or an email draft that sounds certain when the situation is not.

Use three layers, not one security feature

First, control the source. Treat messages from outside the organization as untrusted until their sender and request are verified. A familiar display name is not enough for payment changes, credential requests, document-sharing invitations, or unusual urgency. Confirm consequential requests through a known contact method.

Second, limit the AI’s authority. Inbox summarization and draft preparation are safer starting points than autonomous replies, downloads, forwarding, account changes, or CRM updates. Give the system only the access needed for the task. Keep external sending, financial steps, document execution, and changes to official records behind human approval.

Third, review the result. A security control can reduce risk without making the output correct. Compare the summary with the original messages. Check sender identity, property address, dates, commitments, attachments, links, and requested actions. If the AI flags content as untrusted or behaves unexpectedly, stop the workflow and investigate rather than asking it to push through.

Decide whether this feature applies to your setup

Microsoft’s announcement is specifically about Microsoft 365 Copilot architecture and tenant configuration. It does not establish that every Microsoft account, every Copilot experience, or a different email assistant has the same protection. An agent using a personal inbox or another provider should not borrow the claim.

If your brokerage uses Microsoft 365 Copilot, ask the person responsible for the tenant whether the protection is available, whether external-sender identification is configured, and which Copilot email experiences are approved. If no one owns those answers, keep the workflow read-only and avoid client-sensitive or transaction-critical use until the boundaries are clear.

A practical AI email safety checklist

  • Confirm which account, Copilot product, license, and tenant are actually in use.
  • Ask an authorized administrator whether external email is identified as untrusted.
  • Start with fictional messages in a nonproduction test.
  • Limit the first workflow to summaries or drafts with no automatic sending.
  • Include one harmless test message containing an irrelevant instruction.
  • Check whether the summary preserves useful facts without following that instruction.
  • Verify sender, address, dates, links, attachments, and requested actions against the originals.
  • Confirm sensitive requests through a known second channel.
  • Keep replies, CRM changes, downloads, and high-impact actions under human approval.
  • Record unexpected behavior and pause the workflow until it is understood.

The practical decision today

AI can make email triage faster, but the right operating rule is simple: messages are information to evaluate, not commands for the assistant to obey. Microsoft’s new boundary may strengthen that rule inside eligible Microsoft 365 Copilot environments. Your process still needs limited permissions, verified requests, and a human decision before anything important happens.

If you want help designing one useful AI task with clear permissions and review points, join the free AI Agents for Agents Skool community. The complete implementation lessons, prompts, and testing resources live there.

Primary source: Microsoft Copilot Blog, “Building Trust-Aware Controls for AI: Differentiated handling of untrusted content”, published October 13, 2026. Microsoft says availability and behavior may vary by release status and tenant environment.

This article is educational and does not provide individualized legal, security, privacy, fair-housing, or compliance advice. Confirm current Microsoft documentation, brokerage policy, account controls, and applicable requirements before using AI with business email or client information.

Let AI prepare. Keep people in control.

Build the boundary before you connect the inbox.

Join the free community for practical lessons on testing AI workflows with limited permissions and visible human review.

Join AI Agents for Agents free on Skool