Prompt Injection and AI Security: The Vulnerability That No One Has Solved Yet

In June 2025, a single email was enough to silently clear the context of Microsoft 365 Copilot (emails, OneDrive files, Teams conversations) without any employee having to click on anything. This vulnerability CVE-2025-32711, dubbed EchoLeak, illustrates better than any theoretical demonstration why prompt injection ranks first on the OWASP list of LLM application vulnerabilities for the second consecutive year: this is not a hypothetical risk, but an attack vector that has already been exploited against production systems at Microsoft, Google, GitHub, and OpenAI between 2025 and 2026.

Prompt Injection and AI Security: A Structural Flaw

Prompt injection exploits an architectural limitation of large language models: an LLM receives system instructions and data provided by the user or retrieved from an external source as a single text stream, with no reliable way to structurally distinguish between the two. An attacker who manages to formulate data as if it were a command can therefore divert the model from its original purpose; this is the single mechanism underlying all variants of this attack.

Types of prompt injection: direct, indirect, and stored

Direct injection prompt

Direct prompt injection occurs when an attacker manually enters malicious instructions into the prompt, typically to bypass a chatbot’s safeguards; this is the most well-documented variant, but also the easiest to mitigate, since it involves direct and traceable interaction with the system.

Indirect prompt injection

Indirect prompt injection is currently the most widespread and difficult-to-contain category: the attacker hides their instructions within content that the AI accesses on its own initiative (an email, a web page, a shared document) without ever interacting directly with the targeted system. This is precisely how EchoLeak works: an email containing a hidden instruction, invisible to the user but read and executed by Copilot’s RAG engine as it summarized the latest messages in the inbox.

Stored injection prompt

Stored injection adds a layer of latency: the malicious instruction is stored in long-term memory, an indexed document database, or a knowledge base, and is activated only later, when a legitimate user queries that source, making it significantly more difficult to trace the origin of the attack after the fact.

EchoLeak: A Real-World Case of a Prompt Injection Vulnerability

The EchoLeak case (CVE-2025-32711, critical severity, CVSS 9.3) is worth examining in detail because it clearly illustrates how this theoretical vulnerability translates into a concrete risk. Researchers at Aim Security demonstrated that a specially crafted email—containing an instruction hidden in plain text on a white background or in an invisible HTML comment—was enough to trigger the exfiltration of sensitive data to a server controlled by the attacker, without the victim having to click anything. Once the email’s content was retrieved by Copilot’s RAG engine in response to a harmless user query, the hidden instruction was executed as if it came from a legitimate source.

Subsequent technical analysis showed that the attack chained together four distinct bypasses to achieve its objective: it evaded Microsoft’s proprietary anti-injection classifier, bypassed link sanitization, and exploited an authorized image proxy to complete the exfiltration. Microsoft patched the server-side vulnerability in June 2025, with no actual exploitation confirmed prior to the publication. The patch resolved this specific case; however, the risk category it illustrates—an AI assistant with broad access to internal data, capable of processing untrusted content as if it were legitimate instructions—remains an open risk for any AI assistant built on a comparable architecture.

Protection Against Prompt Injection: Why No Defense Is Definitive

This is the most honest point to make in this guide, even if it disappoints those looking for a one-size-fits-all solution: every mitigation measure currently available reduces the probability of a successful attack, but none of them eliminates it entirely. Delimiter compartmentalization—which involves explicitly marking the boundaries between system instructions and external content—helps the model better distinguish between the two, though it never guarantees this distinction in every case. Repeating the original instruction at the end of the prompt—a technique sometimes called “sandwich defense”—reinforces the user’s initial intent without preventing sufficiently clever content from circumventing it. Specifically training the model to resist these techniques reduces the overall attack surface, at the cost of costly retraining that offers no guarantee against variants not yet known at the time of training.

This reality has a direct impact on the approach we should take: defense against prompt injection should never rely on a single measure, no matter how sophisticated it may be, but on a systematic reduction of the potential impact, foremost among which is strictly limiting what an AI agent or assistant can access, regardless of its ability to resist the injection itself.

How can we reduce the risk of rapid injection?

• Restrict access at the source: An assistant who has access only to the data strictly necessary for their task automatically limits what a successful injection can expose, even if the model’s defenses are bypassed.
• Treat all external content as untrustworthy: emails, web pages, and shared documents should be treated as potentially malicious data before being fed into an AI system, just as unvalidated user input would be treated in a traditional application.
• Logging and categorizing interactions: The ability to distinguish retrospectively between direct, indirect, or cached injections in the interaction logs is key to fixing the exploited vulnerability rather than merely addressing an isolated symptom.
• Actively testing rather than assuming protection is in place: a penetration test specifically tailored to injection scenarios—both direct and indirect—remains the only way to verify that a purported security measure can actually withstand an attempt to circumvent it.

→ See our guide to AI architectures and risk vectors to understand how this vector fits into the broader AI architecture, and our AI penetration testing services to assess how resilient your systems really are against these scenarios.

FAQ: Prompt Injection and AI Security

Test the resilience of your AI systems against prompt injection

Our experts assess the actual exposure of your AI systems to this threat vector and actively test their resilience as part of our AI penetration testing service. Would you like to discuss your project or assess your needs? Contact our experts.