EchoLeak Proves AI Assistants Cannot Defend Against Prompt Injection Alone
Source
The EchoLeak flaw taught us that all models are vulnerable to prompt injection
Microsoft
Via Microsoft
What happened
A commentary published by SC Media on November 11, 2026, authored by Itay Ravia of Cato Networks, analyzed the EchoLeak flaw and its lasting lessons for enterprise AI security. EchoLeak worked by embedding hidden instructions in an email. When Microsoft Copilot read the email while answering a routine user question, it followed those instructions. It then exfiltrated sensitive data by triggering the browser to load an attacker-controlled image. Microsoft patched the specific flaw in May 2025. However, the article argues the root cause remains unfixed across all AI assistants. No model can reliably tell the difference between data it should read and instructions it should follow. The article notes that OpenAI has separately disclosed that its own models can be tricked by injected instructions that copy themselves into an agent's output. By 2026, AI assistants can send email, update records, and call internal systems. The article warns that the same attack class now carries a far larger potential impact. The original EchoLeak incident affected only data readable by Copilot at the time.
Why it matters
- ·Broad data access granted to AI assistants like Copilot creates a data-loss risk that model-level safety guardrails cannot close on their own. Any AI assistant that reads external content, such as email or shared documents, and can access sensitive internal data is a potential exfiltration path. This applies regardless of which vendor supplies it.
- ·Enterprises relying on AI vendors to block prompt injection as a product feature are exposed. The article explicitly states all models are vulnerable and vendors acknowledge it. This risk must be governed as an enterprise architectural problem, not a vendor warranty. Frameworks such as the NIST AI Risk Management Framework (AI RMF 1.0) and Playbook and the OWASP Top 10 for Large Language Model Applications both treat prompt injection as a persistent, unresolved threat requiring layered organizational controls.
- ·The expansion of AI assistant permissions, including sending email, modifying records, and calling internal systems, means a successful prompt injection can now trigger real-world actions, not just read data. This raises the stakes for human approval gating and least-privilege access policies that many organizations have not yet applied to AI tools.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit which AI assistants in your organization can read external content such as email, documents, or web pages AND also have access to sensitive internal data or can take actions like sending messages or updating records. This combination is the attack surface EchoLeak exploited.
- ☐Review whether your AI assistant deployments restrict what data each tool can access based on the signed-in user's own permissions, not a broad shared credential. If the tool can retrieve any employee's data, that is a code-level architectural gap, not a prompt setting.
- ☐Identify every output channel available to AI assistants in your environment, including image rendering, link previews, and external web requests. Disable any channel not required for the tool's business purpose, as EchoLeak used an auto-loaded image to move data out.
- ☐Require human approval before AI assistants can take consequential actions such as sending external email, calling external systems, or modifying records. Confirm this gate is enforced in application code, not in the AI model's instructions.
- ☐Ask your security team whether your AI vendor's prompt injection defenses rely solely on the model's own judgment, or whether independent, code-enforced checks sit outside the model and block unauthorized data access and outbound data movement.
What to watch next
Prompt injection as a named threat category is now codified in MITRE ATT&CK v20, as covered in MITRE ATT&CK v20's naming of prompt injection and AI agent abuse. Regulators and auditors are increasingly likely to ask for documented controls. As AI assistants expand to agentic workflows with broader permissions, enforcement attention is growing. The EU AI Act (Regulation (EU) 2024/1689) and the Five Eyes Guidance on the Careful Adoption of Agentic AI Services are likely to formalize expectations around least-privilege access and output controls for AI systems. Organizations should monitor whether Microsoft and other AI assistant vendors publish updated architectural guidance on exfiltration channel controls in response to continued research on this attack class.