Analysis
The Lethal Trifecta in Production: How Enterprise Copilots Quietly Became Exfiltration Tools | Amine Raji, PhD
First reported · Discovered aminrj.com
Page published
Earliest dated coverage: 21 Sep 2026 · First observed: 15 Oct 2026 · Latest dated coverage: 21 Sep 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
The lethal-trifecta analysis shows defenders that prompt injection is now a practical, high-severity vulnerability class in deployed enterprise AI, and that layered content filters failed where architectural controls like least privilege and data scoping are required.
Amine Raji's write-up applies Simon Willison's "lethal trifecta" framework (private data access, exposure to untrusted content, and an outbound communication path) to document how enterprise copilots became silent data-exfiltration tools across 2025. It walks through named production vulnerabilities including EchoLeak (CVE-2025-32711, CVSS 9.3) a zero-click prompt injection against Microsoft 365 Copilot, and ForcedLeak (CVSS 9.4) against Salesforce Agentforce where a hidden instruction in a Web-to-Lead form exfiltrated CRM data via an expired trusted domain bought for five dollars.