Analysis · curated 18 Sep 2026
Reliability starts with separating instruction from content
First reported microsoft.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
EchoLeak illustrates that any AI assistant with access to multiple internal data sources shares the same indirect-prompt-injection exfiltration surface, and shows how instruction/content separation (Spotlighting) mitigates it.
A Microsoft community forum post recaps EchoLeak (CVE-2025-32711, CVSS 9.3), a zero-click indirect prompt injection in Microsoft 365 Copilot discovered by Aim Security, where a malicious email caused Copilot to exfiltrate internal data via markdown and an allowlisted Teams image proxy, bypassing XPIA classification and link redaction. The post explains Microsoft Research's Spotlighting defense (delimiting, datamarking, encoding) now part of Prompt Shields in Azure AI Content Safety, which reduced indirect injection success from over 50% to under 2% in tests. Microsoft shipped a server-side fix in June 2025 with no confirmed real-world exploitation.