A vulnerability tied to Microsoft 365 Copilot underscores a harder lesson for defenders: once AI assistants can read mail, files, and internal data, untrusted content becomes a security boundary problem, not just a productivity issue.