You didn’t click. You didn’t open. You just browsed to the folder.

And your AI assistant just exfiltrated your data.

Microsoft’s March 2026 Patch Tuesday included an unusual disclosure: CVE-2026-26144, a high-severity information disclosure flaw that combines cross-site scripting with indirect prompt injection to weaponize Microsoft Copilot for zero-click data exfiltration.

The attack vector? The preview pane.

The Vulnerability

The attack works because Excel fails to properly sanitize malicious content embedded in spreadsheet files. Normally, when a threat actor sends an Excel file containing a malicious link or hidden instruction, the program should neutralize that input before processing it.

But here’s the twist: the malicious content executes even if the victim never opens the file - viewing it in the preview pane is enough.

The Attack Chain

The attack combines two vulnerability classes:

1. Cross-Site Scripting (XSS): Malicious input embedded in the Excel file executes when rendered in the preview pane
2. Indirect Prompt Injection: The XSS payload contains instructions that Copilot interprets as legitimate commands

When Copilot is active, the hidden instruction tells the AI assistant to send sensitive data - financial records, intellectual property, operational data - to an attacker-controlled server. No clicks. No confirmations. No user awareness.

Welcome to Ambient Attacks

This vulnerability represents a broader pattern we’re calling ambient context attacks: exploits that target the passive data processing AI assistants perform in the background.

Modern AI assistants don’t wait for explicit commands. They continuously process environmental context - email subjects, calendar titles, document previews, browser tabs - to provide proactive assistance.

This is a feature. It’s also an attack surface.

The Traditional Model Is Broken

For decades, security awareness training taught users: “Don’t open suspicious attachments.” This advice assumed a single, discrete moment when a user decides to engage with potentially malicious content.

AI assistants eliminate that moment.

When Copilot, Gemini, or Claude continuously analyze ambient context to “help,” they process content the user never explicitly chose to view. The preview pane becomes an execution surface. Email notifications become injection vectors. Calendar event titles become command interfaces.

Not Just Excel: The Preview Pane Epidemic

CVE-2026-26144 wasn’t alone in March’s Patch Tuesday. Microsoft also fixed two additional critical flaws exploitable via the preview pane:

These preview pane vulnerabilities have become increasingly common over the past year. It’s only a matter of time before they appear in active exploits at scale.

OWASP Agentic Top 10 Mapping

This attack pattern maps directly to two critical risks in the OWASP Top 10 for Agentic Applications:

The attack succeeds because:

1. The AI assistant has access to sensitive context (document content)
2. The AI assistant has dangerous capabilities (network egress)
3. No security boundary exists between ambient context and explicit commands
4. No human-in-the-loop checkpoint validates the exfiltration request

Corporate Data at Risk

Consider the attack from an adversary’s perspective:

1. Craft an Excel file with hidden prompt injection payload
2. Send to target via email (or compromise a SharePoint folder)
3. Wait for someone to browse to the folder
4. Copilot processes the preview and exfiltrates data
5. No malware signatures. No suspicious process behavior. Just a normal AI assistant “helping.”

Mitigations

The Broader Lesson

CVE-2026-26144 is a preview of the ambient attack era. As AI assistants become more integrated into productivity tools - processing emails, documents, calendars, and messages to provide proactive assistance - the attack surface expands to include every piece of content they might “notice.”

The security industry spent years teaching users not to click suspicious links. We now face a harder challenge: protecting users from attacks that require no action at all.

Traditional perimeter security assumes a boundary between trusted and untrusted content. AI assistants blur that boundary by design - their value comes from connecting context across applications and data sources.

Protecting these systems requires a new approach: runtime security that validates AI behavior at execution time, regardless of input source. When an AI assistant attempts to exfiltrate data, send a message, or execute a command, security controls must evaluate whether that action aligns with user intent - not just whether the input looked safe.

The preview pane attack worked because nothing checked whether the user actually wanted Copilot to send their financial data to an external server. The input sanitization failed, but even if it had succeeded, the fundamental problem would remain: AI assistants acting on ambient context without validation.