{"id":5040,"date":"2026-08-18T09:43:46","date_gmt":"2026-08-18T09:43:46","guid":{"rendered":"https:\/\/www.hackmosphere.fr\/prompt-injection-and-ai-security-the-vulnerability-that-no-one-has-solved-yet\/"},"modified":"2026-09-03T12:26:09","modified_gmt":"2026-09-03T12:26:09","slug":"prompt-injection","status":"publish","type":"post","link":"https:\/\/www.hackmosphere.fr\/en\/prompt-injection\/","title":{"rendered":"Prompt Injection and AI Security: The Vulnerability That No One Has Solved Yet"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n

In June 2025, a single email was enough to silently clear the context of Microsoft 365 Copilot (emails, OneDrive files, Teams conversations) without any employee having to click on anything. This vulnerability CVE-2025-32711<\/u><\/a>, dubbed EchoLeak<\/em>, illustrates better than any theoretical demonstration why prompt injection<\/u><\/a> ranks first on the OWASP list of LLM application vulnerabilities for the second consecutive year: this is not a hypothetical risk, but an attack vector that has already been exploited against production systems at Microsoft, Google, GitHub, and OpenAI between 2025 and 2026. <\/p>\n

<\/p>\n

Prompt Injection and AI Security: A Structural Flaw<\/h2>\n

<\/p>\n

Prompt injection exploits an architectural limitation of large language models: an LLM receives system instructions and data provided by the user or retrieved from an external source as a single text stream, with no reliable way to structurally distinguish between the two. An attacker who manages to formulate data as if it were a command can therefore divert the model from its original purpose; this is the single mechanism underlying all variants of this attack. <\/p>\n

<\/p>\n

Types of prompt injection: direct, indirect, and stored<\/h2>\n

<\/p>\n

Direct injection prompt<\/h3>\n

<\/p>\n

Direct prompt injection occurs when an attacker manually enters malicious instructions into the prompt, typically to bypass a chatbot\u2019s safeguards; this is the most well-documented variant, but also the easiest to mitigate, since it involves direct and traceable interaction with the system.<\/p>\n

<\/p>\n

Indirect prompt injection<\/h3>\n

<\/p>\n

Indirect prompt injection is currently the most widespread and difficult-to-contain category: the attacker hides their instructions within content that the AI accesses on its own initiative (an email, a web page, a shared document) without ever interacting directly with the targeted system. This is precisely how EchoLeak works: an email containing a hidden instruction, invisible to the user but read and executed by Copilot\u2019s RAG engine as it summarized the latest messages in the inbox. <\/p>\n

<\/p>\n

Stored injection prompt<\/h3>\n

<\/p>\n

Stored injection adds a layer of latency: the malicious instruction is stored in long-term memory, an indexed document database, or a knowledge base, and is activated only later, when a legitimate user queries that source, making it significantly more difficult to trace the origin of the attack after the fact.<\/p>\n

<\/p>\n

EchoLeak: A Real-World Case of a Prompt Injection Vulnerability<\/h2>\n

<\/p>\n

The EchoLeak case (CVE-2025-32711<\/a>, critical severity, CVSS 9.3) is worth examining in detail because it clearly illustrates how this theoretical vulnerability translates into a concrete risk. Researchers at Aim Security demonstrated that a specially crafted email\u2014containing an instruction hidden in plain text on a white background or in an invisible HTML comment\u2014was enough to trigger the exfiltration of sensitive data to a server controlled by the attacker, without the victim having to click anything. Once the email\u2019s content was retrieved by Copilot\u2019s RAG engine in response to a harmless user query, the hidden instruction was executed as if it came from a legitimate source. <\/p>\n

<\/p>\n

Subsequent technical analysis showed that the attack chained together four distinct bypasses to achieve its objective: it evaded Microsoft\u2019s proprietary anti-injection classifier, bypassed link sanitization, and exploited an authorized image proxy to complete the exfiltration. Microsoft patched the server-side vulnerability in June 2025, with no actual exploitation confirmed prior to the publication. The patch resolved this specific case; however, the risk category it illustrates\u2014an AI assistant with broad access to internal data, capable of processing untrusted content as if it were legitimate instructions\u2014remains an open risk for any AI assistant built on a comparable architecture. <\/p>\n

<\/p>\n

Protection Against Prompt Injection: Why No Defense Is Definitive<\/h2>\n

<\/p>\n

This is the most honest point to make in this guide, even if it disappoints those looking for a one-size-fits-all solution: every mitigation measure currently available reduces the probability of a successful attack, but none of them eliminates it entirely. Delimiter compartmentalization\u2014which involves explicitly marking the boundaries between system instructions and external content\u2014helps the model better distinguish between the two, though it never guarantees this distinction in every case. Repeating the original instruction at the end of the prompt\u2014a technique sometimes called \u201csandwich defense\u201d\u2014reinforces the user\u2019s initial intent without preventing sufficiently clever content from circumventing it. Specifically training the model to resist these techniques reduces the overall attack surface, at the cost of costly retraining that offers no guarantee against variants not yet known at the time of training. <\/p>\n

<\/p>\n

This reality has a direct impact on the approach we should take: defense against prompt injection should never rely on a single measure, no matter how sophisticated it may be, but on a systematic reduction of the potential impact, foremost among which is strictly limiting what an AI agent or assistant can access, regardless of its ability to resist the injection itself.<\/p>\n

<\/p>\n

How can we reduce the risk of rapid injection?<\/h2>\n

<\/p>\n