# EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

arXiv: https://arxiv.org/abs/2509.10540 · HTML: https://mlsanity.com/paper/2509.10540/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 5 of its 11 references that are in the map.
- First posted on arXiv 6 Sep 2025.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 5 of 5)

- [Retrieval-Augmented Generation for Large Language Models: A Survey](https://mlsanity.com/paper/2312.10997/) (2023)
- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [Demystifying RCE Vulnerabilities in LLM-Integrated Apps](https://mlsanity.com/paper/2309.02926/) (2023)
- [Language models are better than humans at next-token prediction](https://mlsanity.com/paper/2212.11281/) (2022)

## Built on by (most cited first, 29 of 29)

- [AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations](https://mlsanity.com/paper/2603.10749/) (2026)
- [VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills](https://mlsanity.com/paper/2606.26524/) (2026)
- [How are AI agents used? Evidence from 177,000 MCP tools](https://mlsanity.com/paper/2603.23802/) (2026)
- [Trusted AI Agents in the Cloud](https://mlsanity.com/paper/2512.05951/) (2025)
- [Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives](https://mlsanity.com/paper/2604.27202/) (2026)
- [Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs](https://mlsanity.com/paper/2604.03870/) (2026)
- [Human Society-Inspired Approaches to Agentic AI Security: The 4C Framework](https://mlsanity.com/paper/2602.01942/) (2026)
- [SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification](https://mlsanity.com/paper/2607.13081/) (2026)
- [COPA: Continual Preference Optimization for Adaptive Prompt Injection Defense](https://mlsanity.com/paper/2608.19982/) (2026)
- [The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures](https://mlsanity.com/paper/2609.11030/) (2026)
- [Stop Saying "AI"](https://mlsanity.com/paper/2602.17729/) (2026)
- [IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection](https://mlsanity.com/paper/2605.11868/) (2026)
- [The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems](https://mlsanity.com/paper/2605.22842/) (2026)
- [CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?](https://mlsanity.com/paper/2608.27990/) (2026)
- [Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents](https://mlsanity.com/paper/2608.29942/) (2026)
- [When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI](https://mlsanity.com/paper/2605.03213/) (2026)
- [From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI](https://mlsanity.com/paper/2605.16471/) (2026)
- [An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments](https://mlsanity.com/paper/2605.18133/) (2026)
- [Agentic Literacy Debt: A Structural Problem the AI Literacy Field Has Not Yet Named](https://mlsanity.com/paper/2605.27396/) (2026)
- [The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI](https://mlsanity.com/paper/2607.19433/) (2026)
- [Governing Execution Risk in Agentic AI Systems: A Trajectory-Guided Framework for Red Teaming](https://mlsanity.com/paper/2608.04018/) (2026)
- [Agent Safety Should Be a Runtime Contract](https://mlsanity.com/paper/2608.11274/) (2026)
- [How Language Models Choose Sides: Internal Representations of Instruction Hierarchy](https://mlsanity.com/paper/2608.28648/) (2026)
- [Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection](https://mlsanity.com/paper/2609.04533/) (2026)
- [Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents](https://mlsanity.com/paper/2609.22510/) (2026)
- [When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems](https://mlsanity.com/paper/2609.23700/) (2026)
- [Beyond Predictable Paths: Redefining AI Security Incident Reporting for Agents](https://mlsanity.com/paper/2609.24515/) (2026)
- [RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents](https://mlsanity.com/paper/2610.06401/) (2026)
- [Prompt-Injection Probes Learn the Conversation, Not Just the Injection](https://mlsanity.com/paper/2610.18408/) (2026)

## Abstract (arXiv)

Large language model (LLM) assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources. This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email. By chaining multiple bypasses-evading Microsofts XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy-EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction. We analyze why existing defenses failed, and outline a set of engineering mitigations including prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies. Beyond the specific exploit, we derive generalizable lessons for building secure AI copilots, emphasizing the principle of least privilege, defense-in-depth architectures, and continuous adversarial testing. Our findings establish prompt injection as a practical, high-severity vulnerability class in production AI systems and provide a blueprint for defending against future AI-native threats.