Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read EchoLeak is a zero-click prompt injection exploit in Microsoft 365 Copilot that the paper presents as the first confirmed real-world case of a production LLM assistant being weaponized to exfiltrate data.

desk verdict A tidy secondary writeup of a real CVE; the value is the synthesis, not new findings, and the Table 3 'in our tests' claim must be fixed. read the letter →

arxiv 2509.10540 v1 pith:7KHZP4BI submitted 2025-09-06 cs.CR cs.AI

Pavan Reddy , Aditya Sanjay Gujral This is my paper · ORCID
classification cs.CRcs.AI
keywords promptinjectionzero-clickexploitLLMsecurityMicrosoft365Copilotdataexfiltrationretrieval-augmentedgenerationcontentpolicyindirect
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that EchoLeak (CVE-2025-32711) is the first confirmed real-world zero-click prompt injection exploit in a production LLM system: a single attacker-crafted email, when ingested by Microsoft 365 Copilot during ordinary retrieval, can make Copilot embed sensitive data from the user's context into a Markdown image URL that the client automatically fetches, exfiltrating the data to the attacker with no user interaction. It analyzes the four-step chain that bypasses Microsoft's prompt-injection classifier, link redaction, image auto-fetch restrictions, and content security policy via an allow-listed Teams URL-preview proxy. If correct, the case moves prompt injection from a theoretical risk to a practical, high-severity vulnerability class in enterprise AI assistants. The paper also derives engineering defenses, such as prompt partitioning, provenance-based access control, output policy gates, and strict content security policies, along with general lessons for secure AI copilot design.

What carries the argument

The load-bearing mechanism is a chain of four bypasses around a single rendered message. The central object is the reference-style Markdown link (for example, `[text][ref]` with a separate `[ref]: URL` line), which the paper says Microsoft's link redaction did not recognize, unlike inline `[text](URL)` links. That link is rendered as an image (`![alt][ref]`), causing the browser or client to auto-fetch the URL without user action. The final piece is an allow-listed Microsoft Teams asynchronous preview proxy that fetches arbitrary URLs on behalf of the client, turning a blocked external domain into a permitted exfiltration channel. Together these convert Copilot's normal helpful behavior, retrieving, summarizing, and rendering content, into a data-egress pipeline.

What would settle it

Send a crafted email containing hidden instructions to a test tenant, have the victim invoke Copilot to summarize recent email, and inspect the rendered output: if the reference-style image link is redacted, the client refuses to fetch it, or the Teams preview endpoint rejects the external URL, the described chain fails at that step. A reproduction showing that the XPIA classifier flags the crafted phrasing, or server logs showing the proxy refused the request, would also falsify the paper's central claim.

Watch

Extended reading notes

Core claim

On the paper's account, EchoLeak is an 'LLM scope violation': an external attacker, without any authenticated access to Copilot, sends the victim an email whose hidden instructions survive retrieval and classification. When the victim later asks Copilot to summarize or search internal content, Copilot follows the embedded instructions and produces an answer containing a reference-style Markdown image link whose URL encodes the sensitive material. The chat client renders the answer and automatically fetches the image; the fetch targets a Microsoft Teams URL-preview endpoint that is on the content-security-policy allowlist and that proxies the request to the attacker's server, delivering the secret in the request path. The paper claims that the XPIA classifier missed the subtly phrased injection, that reference-style links evaded the output redaction designed for inline Markdown links, and that no user click is needed at any point. The result, per the paper, is the first demonstrated zero-click data exfiltration through a production LLM assistant, assigned CVE-2025-32711 and closed by a server-side fix.

Load-bearing premise

The paper assumes the public disclosure's technical account of the four bypasses is accurate, since it never reproduces the attack and acknowledges that proprietary filters and model differences make some conclusions inferential.

Editorial extensions

If this is right

  • Prompt injection in production LLM assistants must be treated as a practical, high-severity vulnerability class rather than a theoretical concern.
  • Single-layer defenses, such as input classifiers, link redaction, and CSP allowlists, are insufficient because each can be bypassed under modest adversarial pressure.
  • External content like incoming email should be isolated from internal context by provenance, with internal-only retrieval as the default.
  • Output rendering must be constrained to a safe subset that blocks external images and arbitrary URLs, paired with strict network egress controls.
  • Continuous adversarial red-teaming of retrieval, rendering, and egress paths is necessary for AI copilots.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same chain likely applies to any RAG assistant whose markdown renderer auto-fetches images and whose output sanitizer only handles inline links, so reference-style link gaps are a generic risk rather than a Copilot-specific flaw.
  • The Teams-proxy step suggests a broader pattern: any allow-listed URL-preview or unfurl endpoint can serve as an exfiltration proxy, so CSP allowlists alone do not establish a real network boundary.
  • A testable extension is to reproduce the attack in a sandboxed Copilot-like system with a monotonic filter baseline; if reference-style image links survive sanitization, the core bypass is confirmed independently of Microsoft's proprietary details.
  • Because the exploit requires zero clicks, the barrier to mass exploitation is low, which makes defense-in-depth and egress monitoring more urgent than user-awareness training.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents a case study of EchoLeak (CVE-2025-32711), a claimed zero-click prompt injection vulnerability in Microsoft 365 Copilot. Based on public disclosures by Aim Labs and Microsoft, the authors describe a four-step attack chain: bypassing the XPIA classifier, evading link redaction via reference-style Markdown, exploiting automatic image fetching, and abusing a Microsoft Teams preview API as a CSP-allowed proxy for exfiltration. The paper also proposes a set of engineering mitigations and derives lessons learned for securing LLM-integrated enterprise systems. The authors explicitly state that they did not reproduce the attack or run experiments, and that some conclusions are inferential.

Significance. If the attack chain is accurately described, the paper documents a significant real-world security event: a remote, unauthenticated, zero-click data exfiltration from a major production LLM assistant. The paper's main value is as a structured secondary analysis, assembling a threat model, kill-chain diagram, and mapping to security frameworks (OWASP, NIST SP 800-53). The mitigation discussion, while largely standard, is sensibly organized and includes a useful theoretical matrix. However, the paper offers no independent verification of the attack mechanics, no experiments, and no new empirical data; its central technical claims rest entirely on a single third-party disclosure. The authors are commendably transparent about these limitations, but the manuscript does not currently meet the evidentiary bar for presenting the attack chain as established fact.

major comments (4)
  1. [Limitations & Future Work; EchoLeak Analysis] The paper states in Limitations that 'we did not reproduce the attack or run any experiments' and that 'some conclusions are inferential,' yet the main analysis in the EchoLeak Analysis section presents the four-step chain (XPIA bypass, reference-style Markdown, image auto-fetch, Teams proxy) as established fact, citing only Aim Labs. Because these steps are load-bearing for the paper's central claim of a zero-click exploit, the manuscript must either (a) provide independent verification (e.g., a sandbox reproduction or a direct test of the specific sanitizer and proxy behaviors), or (b) reframe the contribution as a secondary account that explicitly attributes each step to the original disclosure and marks the inferential status throughout. As written, the epistemic reliance on a single source is concealed by the assertive prose.
  2. [Table 3] The caption of Table 3 states that 'Cells marked with ✓ indicate full coverage in our tests; × indicates at least one bypass,' but the Limitations section says the authors 'did not reproduce the attack or run any experiments.' This is an internal contradiction on a point that directly affects the credibility of the mitigation matrix. The caption must be corrected to indicate that the mapping is a theoretical assessment, not the result of testing.
  3. [EchoLeak Analysis, Step 4: CSP Bypass] The zero-click claim hinges on the assertion that the Teams asynchronous preview API (asyncgw.teams.microsoft.com/urlp) accepts an arbitrary URL parameter and performs a server-side fetch. The paper provides no evidence for this behavior beyond Aim Labs' description. If this step is misdescribed, the attack is not zero-click but one-click. The authors should either supply a minimal verification (e.g., a controlled probe of the endpoint or documentation evidence) or explicitly state that this step is unverified and inferred from a single third-party source.
  4. [Abstract and Introduction] The paper claims that EchoLeak is 'the first real-world zero-click prompt injection exploit' in a production LLM system. This uniqueness claim is not independently substantiated; it is taken from Aim Labs' reporting. To support the claim, the paper should either provide a survey of prior incidents to confirm novelty or qualify the claim with a clear attribution (e.g., 'according to Aim Labs'). As it stands, the claim is stronger than the evidence the paper itself marshals.
minor comments (5)
  1. [Throughout] The text repeatedly uses 'OW ASP' where the correct name is 'OWASP' (e.g., Abstract, Introduction, and Table 2).
  2. [Figures 1 and 2] Figures 1 and 2 are referenced in the main text but are not present in the manuscript, so the reader cannot access the diagrams that are central to the attack description.
  3. [Various typos] There are several typos: 'adversary doe not have access' (Threat Model), 'resist xecuting' (Discussion), 'SSRFi' (Content Security Policies), and 'iszero-click' (EchoLeak Analysis).
  4. [References] The reference list is incomplete: several entries (Aim Labs 2025, Center 2025, Rabbit 2025, Microsoft Corporation 2025) lack URLs and access dates, making verification difficult.
  5. [Table 1] In Table 1, the January 2025 row lists multiple sub-events but the text says only that Aim Labs 'created a working proof of concept'; the table and narrative should be aligned.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is a secondary case study that attributes all attack mechanics to external disclosure and performs no independent derivation or fitting.

full rationale

The paper's derivation chain is entirely external: it reports Aim Labs' disclosure of EchoLeak (CVE-2025-32711), summarizes the reported attack chain, and proposes mitigations. Every load-bearing technical step (XPIA bypass, reference-style Markdown redaction gap, image auto-fetch, Teams proxy abuse) is explicitly attributed to Aim Labs 2025, and the paper states in Limitations: 'we did not reproduce the attack or run any experiments.' There are no fitted parameters, no equations whose outputs equal their inputs, and no self-citations by the present authors; the cited sources are third-party disclosures, advisories, and prior literature. The paper makes no novel empirical prediction that could reduce to its inputs. The only notable issue is an internal inconsistency: Table 3's caption says 'Cells marked with ✓ indicate full coverage in our tests,' which conflicts with the Limitations statement that no experiments were run. That is an evidentiary or consistency problem, not a circularity problem, because the table's ratings are not used to derive the existence or mechanism of the vulnerability. Since no circular step can be exhibited by quote and reduction, the circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new entities, particles, forces, or abstract objects. Its central claim rests on external authoritative sources and on unverified assumptions about the behavior of Microsoft's proprietary systems as described in a third-party disclosure.

assumptions (3)
  • domain assumption The Aim Labs disclosure and CVE-2025-32711 accurately characterize the vulnerability and the attack chain.
    The paper's central claim relies entirely on this public disclosure; no independent reproduction is performed.
  • domain assumption Microsoft's XPIA classifier, link redaction, and CSP allowlist behaved in 2025 as described in the Aim Labs disclosure.
    The step-by-step bypass analysis in the 'EchoLeak Analysis' section is inferred from the disclosure, not from direct testing, as the Limitations section admits.
  • domain assumption The Teams asynchronous preview API (asyncgw.teams.microsoft.com/urlp) can fetch attacker-supplied URLs and act as a CSP-approved proxy.
    This is asserted in Step 4 of the vulnerability analysis without any direct verification or a reproducible demonstration.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System." pith.science (2026). https://pith.science/paper/7KHZP4BI

@misc{pith2026250910540,
  author       = {Pith},
  title        = {Pith review of: EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7KHZP4BI}},
  note         = {Machine review of arXiv:2509.10540}
}
read the original abstract

Large language model (LLM) assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources. This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email. By chaining multiple bypasses-evading Microsofts XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy-EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction. We analyze why existing defenses failed, and outline a set of engineering mitigations including prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies. Beyond the specific exploit, we derive generalizable lessons for building secure AI copilots, emphasizing the principle of least privilege, defense-in-depth architectures, and continuous adversarial testing. Our findings establish prompt injection as a practical, high-severity vulnerability class in production AI systems and provide a blueprint for defending against future AI-native threats.

Figures

Figures reproduced from arXiv: 2509.10540 by the authors.

Figure 1
Figure 1. Zero-click exfiltration via EchoLeak (Aim Labs 2025). A crafted external email implants hidden instructions; when [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. EchoLeak kill chain and bypass variants. An attacker seeds an email with hidden instructions; Copilot ingests it [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Beyond Object Validation: Relational Conformance in Multi-Artifact Agent Releases

    cs.SE 2026-07 conditional novelty 6.0 of 10

    Per-object validity does not imply release conformance; a multi-artifact release should only be accepted after its claim/evidence and publication relations are checked on a path separate from the generator's own logic.

  2. The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI

    cs.AI 2026-07 conditional novelty 4.0 of 10

    The paper is a taxonomy of persistent memory-based attacks on AI agents, reinterpreting known attacks (MINJA, EchoLeak, sleeper agents) under the umbrella 'Chronos Vulnerability' and proposing a defense-in-depth architecture.

Reference graph

Works this paper leans on

22 extracted references · 16 canonical work pages · cited by 2 Pith papers

  1. [1]

    Aim Labs . 2025. EchoLeak Vulnerability Found in Microsoft 365 Copilot. Accessed 2025-08-10

    work page 2025

  2. [2]

    AWS Well-Architected Framework . 2025. Security—Generative AI Lens. AWS Documentation

    work page 2025

  3. [3]

    Center, M. S. R. 2025. CVE-2025-32711 -- M365 Copilot Information Disclosure Vulnerability. Accessed 2025-08-10

    work page 2025

  4. [4]

    Gao, Y.; Xiong, Y.; Gao, X.; Jia, K.; Pan, J.; Bi, Y.; Dai, Y.; Sun, J.; Wang, M.; and Wang, H. 2023. Retrieval-Augmented Generation for Large Language Models: A Survey. arXiv preprint arXiv:2312.10997

    arXiv 2023

  5. [5]

    Greshake, K.; Abdelnabi, S.; Mishra, S.; Endres, C.; Holz, T.; and Fritz, M. 2023. Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv preprint arXiv:2302.12173

    arXiv 2023

  6. [6]

    Hines, K.; Lopez, G.; Hall, M.; Zarfati, F.; Zunger, Y.; and K c man, E. 2024. Defending Against Indirect Prompt Injection Attacks With Spotlighting. In Conference on Applied Machine Learning for Information Security (CAMLIS'24), volume 3920. CEUR Workshop Proceedings

    work page 2024

  7. [7]

    Lakshmanan, R. 2025. Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction. The Hacker News

    work page 2025

  8. [8]

    Liu, T.; Deng, Z.; Meng, G.; Li, Y.; and Chen, K. 2023. Demystifying RCE Vulnerabilities in LLM-Integrated Apps. arXiv preprint arXiv:2309.02926

    arXiv 2023

Show all 22 references
  1. [9]

    Liu, Y.; Jia, Y.; Geng, R.; Jia, J.; and Gong, N. Z. 2024. Formalizing and Benchmarking Prompt Injection Attacks and Defenses. In Proceedings of the 33rd USENIX Security Symposium

    2024

  2. [10]

    Microsoft Corporation . 2025. Microsoft 365 Copilot - Service Descriptions. Accessed 2025-08-10

    2025

  3. [11]

    NIST . 2024. Artificial Intelligence Risk Management Framework: Generative AI Profile (NIST AI 600-1). Technical report. Accessed 2025-08-10

    2024

  4. [12]

    NIST NVD . 2025. CVE-2025-32711 Detail. Accessed 2025-08-10

    2025

  5. [13]

    OWASP Cheat Sheets Series Team . 2025. Content Security Policy Cheat Sheet

    2025

  6. [14]

    OWASP Foundation . 2025 a . LLM Prompt Injection Prevention Cheat Sheet

    2025

  7. [15]

    OWASP Foundation . 2025 b . OWASP Top 10 for Large Language Model Applications (Version 2025). Accessed 2025-08-10

    2025

  8. [16]

    Perez, F.; and Ribeiro, I. 2022. Ignore Previous Prompt: Attack Techniques For Language Models. arXiv preprint arXiv:2211.09527

    2022 arXiv

  9. [17]

    Rabbit, A. 2025. EchoLeak: The Zero-Click AI Vulnerability That Shook Microsoft Copilot — Analysis & Lessons. Accessed 2025-08-10

    2025

  10. [18]

    Shlegeris, B.; Roger, F.; Chan, L.; and McLean, E. 2024. Language Models Are Better Than Humans at Next-token Prediction. Transactions on Machine Learning Research

    2024

  11. [19]

    Shvetsova, O.; Katalshov, D.; and Lee, S.-K. 2025. Innovative Guardrails for Generative AI: Designing an Intelligent Filter for Safe and Responsible LLM Deployment. Applied Sciences, 15(13): 7298

    2025

  12. [20]

    Warren, T. 2023. These are Microsoft's Bing AI secret rules and why it says it's named Sydney. The Verge

    2023

  13. [21]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  14. [22]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.