For two years the standard reassurance about prompt injection was that it required a user to paste something, click something, or otherwise cooperate. EchoLeak ended that. Disclosed by Aim Security and assigned CVE-2025-32711 with a CVSS score of 9.3, it is the first documented zero-click exploit against a production LLM assistant. The attacker sends a business email. The victim never has to open a link or run a macro. When the user later asks Copilot an unrelated question, Copilot ingests the malicious email as part of its retrieval context, follows the hidden instructions inside it, pulls sensitive data from the user's other messages and files, and encodes that data into a URL that leaks it back out.
The mechanism: a scope violation, not a jailbreak
Aim Security described EchoLeak as an LLM Scope Violation. That framing matters. The exploit does not convince the model to be evil. It convinces the model to combine two things that should never have been in the same trust boundary: untrusted content that arrived from outside the organization (the attacker's email) and trusted content the user is entitled to see (their inbox, their SharePoint). Copilot's default behavior was to retrieve across both and reason over them as one undifferentiated blob of text. Once attacker text and victim data share a context window, the attacker text can issue instructions about the victim data.
The exfiltration step is the part defenders keep underestimating. It is not enough to stop the model from being instructed; you also have to stop the answer from leaving. EchoLeak's payload smuggled stolen content into an outbound reference — a link or image URL the rendering surface would resolve — so the data walked out through a channel nobody was watching. This is the same shape as a classic web SSRF or a DNS-exfil beacon, rebuilt on top of an AI assistant that has both broad read access and the ability to emit markup.
A scope violation is a trust-boundary failure: external, attacker-controlled text is retrieved into the same window as the user's private data, and then gets to speak about it. The fix is to keep provenance attached and to control what may leave.
No link is clicked. The crafted email is retrieved into Copilot's context alongside private data, the hidden instruction encodes that data into an outbound URL, and it leaves. Egress inspection is the link that stops it.
Why patching Copilot did not close the class
Microsoft fixed the specific instance. That is good and it is also not the point. EchoLeak is a property of a design pattern, not of one product: give a language model read access to a corpus, let untrusted documents into that corpus, and let the model emit content to an outbound channel. Every enterprise assistant, every retrieval-augmented agent, and every MCP-connected tool chain that ingests email, tickets, wikis, or web pages inherits the same three ingredients. If you run any assistant over mixed-trust data, you have an EchoLeak-shaped surface whether or not you use Copilot.
Where a runtime gateway breaks the chain
EchoLeak needs three links to succeed: untrusted content reaches the model, the model acts on the injected instruction, and the stolen data leaves through an outbound reference. A checkpoint at the gateway can break any one of them, and breaking any one is enough. This is the posture we build toward at Intertrace, and it is worth being precise about what each control actually does rather than promising immunity.
Ingress classification, pre-action authorization, and egress inspection each break the chain on their own — and each fails closed, so a degraded guard denies rather than passes.
- Inbound classification: score retrieved content for injection patterns before it reaches the model, and label its provenance so the model — and the policy layer — knows which spans came from outside the trust boundary.
- Outbound inspection: this is the link most products skip. Inspect the model's response for data-shaped payloads embedded in URLs, images, and markup, and block or redact egress that would carry the user's context off-platform.
- Fail-closed enforcement: when the classifier is unavailable or a decision is ambiguous, deny rather than pass. An exfiltration path that opens whenever a guard times out is not a guard.
- Evidence: record the decision — what was flagged, which span, what was blocked — as an event you can retrieve when someone asks what happened on a Tuesday.
None of these make prompt injection solved; the OWASP community is explicit that it is not. What they do is convert a silent, zero-click exfiltration into a logged, denied event — and remove the assumption that the model's own good behavior is the only thing standing between an inbound email and your data.