A prolonged Microsoft 365 outage disrupted businesses and government users worldwide, affecting Outlook, Teams, Copilot and other workplace services. The incident coincided with separate service disruptions involving Cloudflare and Anthropic’s Claude integrations, raising fresh concerns about the reliability of cloud infrastructure.
At the same time, cybersecurity researchers reported that attackers are increasingly using artificial intelligence tools to automate intrusions, target organisations and accelerate the exploitation of existing vulnerabilities.
Microsoft 365 Outage Disrupts Outlook, Teams and Copilot
Microsoft‘s global service disruption began on November 12 and continued into Friday, November 13, affecting Outlook, Teams, Microsoft 365 Copilot, SharePoint and Exchange Online.
Microsoft said several servers had become unexpectedly unavailable, placing additional pressure on the remaining infrastructure. The company also identified problems involving a process responsible for establishing secure connections on affected servers.
Recovery efforts included pausing deployments, restarting servers and reversing a network settings change that may have contributed to the disruption. Microsoft warned that some servers restored to service could become unresponsive again when they received traffic.
Downdetector recorded nearly 140,000 global Outlook problem reports around 18:00 GMT on Thursday, according to figures cited by the BBC. The outage affected businesses and government offices, while electric truck manufacturer Workhorse Group postponed its third-quarter earnings report to November 16, citing the disruption.
Microsoft did not indicate that the outage was caused by a cyberattack.
Separately, users reported disruptions involving Cloudflare and Anthropic’s Claude. Cloudflare reported elevated error rates affecting its Durable Objects service in North America, but marked the incident as resolved at 3:44 UTC on November 13.
Claude users faced problems with Microsoft 365 connectors, affecting access to workplace emails, calendars and search functions. Anthropic linked these connector-related issues to the disruption affecting Microsoft’s services. The incidents did not establish a common cause across all three companies.
Researchers Warn of AI-Assisted Cyberattacks
Palo Alto Networks’ Unit 42 reported that Chinese-speaking attackers used an open-source AI framework called Cairn, alongside Chinese AI models DeepSeek and Zhipu GLM, to target 19 organisations over approximately two weeks.
The targets included organisations in the semiconductor and advanced-manufacturing supply chain, defence-related groups and human rights organisations. Unit 42 said the framework could plan, execute and document attacks after receiving a target and an objective.
In one reported incident involving a US teachers’ union, attackers accessed more than one million member records, approximately 31,000 CRM contacts and staff password hashes. At an industry standards organisation, attackers reportedly overwrote a live standards-ballot document.
Unit 42 assessed with moderate confidence that the campaign was linked to Chinese intelligence collection. That assessment remains the research firm’s attribution, rather than an independently established finding.
Other cybersecurity researchers also identified AI-assisted attacks. Symantec reported an intrusion targeting a US retailer in which attackers shifted from manually entered commands to lengthy PowerShell scripts that appeared to contain AI-generated reasoning.
Arctic Wolf Labs separately identified attacks using AntiFox, a Chinese-language agentic penetration-testing platform, against Microsoft IIS servers and AWS environments. In one incident, attackers made hundreds of API requests within roughly 30 minutes and retrieved a production secret.
Researchers noted that many of the attacks relied on familiar weaknesses, including weak credentials and outdated software. AI appears to be increasing the speed and scale of exploitation rather than eliminating the need for conventional security vulnerabilities.
The developments highlight two separate challenges for technology companies: maintaining the reliability of increasingly interconnected cloud services and defending against attackers using AI to automate parts of the intrusion process.
Which Microsoft services were affected by the outage?
The disruption affected Outlook, Teams, Microsoft 365 Copilot, SharePoint, Exchange Online and related workplace services.
How long did the Microsoft outage last?
The outage began on November 12 and continued into November 13. Microsoft reported ongoing recovery efforts, with no immediate full-recovery timeline in the supplied updates.
Was the Microsoft outage caused by a cyberattack?
Microsoft did not indicate that the incident was caused by a cyberattack. The company attributed the disruption to server availability and infrastructure problems.
Why did Claude experience problems?
Some Claude users experienced difficulties with Microsoft 365 connectors, which affected access to workplace emails, calendars and search functions. Anthropic linked these problems to Microsoft’s service disruption.
How are hackers using artificial intelligence?
Researchers reported that attackers are using AI frameworks and models to automate planning, generate scripts, execute commands and accelerate the exploitation of security weaknesses.
