CVE 2025 32711 is a turning point

Last week, we saw the first confirmed zero click prompt injection breach against a production AI assistant.
No malware. No links to click. No user interaction.
Just a cleverly crafted email quietly triggering Microsoft 365 Copilot to leak sensitive org data as part of its intended behavior.