AI Security

Prompt Injection: The Vulnerability AI Can't Patch

Prompt injection is OWASP's top LLM risk. How EchoLeak and the Copilot RCE turned hidden instructions into zero-click data theft and remote code execution.

TL;DR

Prompt injection is OWASP's #1 LLM security risk (LLM01:2025) — the LLM can't reliably tell your instructions apart from instructions hidden in the data it reads.
It's no longer theoretical: EchoLeak (CVE-2025-32711, CVSS 9.3) turned a single email into zero-click data exfiltration from Microsoft 365 Copilot.
GitHub Copilot RCE (CVE-2025-53773, CVSS 7.8 HIGH) showed how prompt injection in repository content could lead Copilot/Visual Studio to execute local commands by altering security-sensitive configuration — with researchers demonstrating wormable propagation scenarios.
Direct injection comes from the user; indirect injection hides in emails, web pages, code comments, and documents the model ingests.
There is no single complete fix; mitigation requires defense in depth — scoped data access, privilege separation, output sandboxing, and treating all model-read content as untrusted.

Every other class of bug we patch and move on. Prompt injection is different — it doesn't exploit a flaw in the code, it exploits the thing that makes an LLM useful: its willingness to follow instructions written in plain language. When the model can't tell your instruction from an instruction buried in the email it just summarized, the house edge quietly shifts to whoever wrote that email. In 2025 that stopped being a parlor trick and started shipping as critical CVEs against Microsoft and GitHub's AI-assisted developer tooling. This is the bad beat of the AI era: you did everything right, and the table still took your stack.

What prompt injection actually is — and why it's structural

A prompt injection vulnerability occurs when input alters an LLM's behavior or output in ways the developer never intended.^[1] The crucial detail: these inputs don't have to be human-visible to work. As long as the model parses the content — invisible Unicode, white-on-white text, metadata — the instruction lands.^[1]

The reason this is so hard to fix is architectural. A traditional injection bug, like SQL injection, has a clean boundary between code and data that you can sanitize. An LLM has no such boundary. The system prompt, your query, and the untrusted document it just read all arrive as the same undifferentiated stream of tokens. The model decides what to obey based on meaning, and meaning is exactly what an attacker controls.

OWASP ranks prompt injection as LLM01:2025, the first risk in its Top 10 for LLM Applications.^[2][3] Published evaluations have reported prompt injection success rates ranging from roughly 50% to 84% under specific testing conditions, and even frontier models from OpenAI, Google, and Anthropic remain vulnerable after their best defenses are applied.^[2]

Direct vs. indirect

Direct injection is the user talking to the model: "ignore your previous instructions and…". Annoying, but the attacker and victim are the same person, so the blast radius is small.

Indirect injection is where it gets lethal. The payload hides inside content the model fetches on your behalf — a web page, a PDF, an email, a code comment, a calendar invite. You never see it. The model reads it as part of doing its job, and obeys.^[3] First formally described by Greshake et al. in 2023, indirect injection is the vector behind nearly every serious real-world incident since.

EchoLeak proved zero-click data theft is real

In June 2025, researchers at Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3) — reported by researchers as the first known zero-click prompt injection exploit causing concrete data exfiltration in a production LLM system.^[4][5] No malware. No click. Just an email.

The attack chained several bypasses into a single clean exploit. The malicious email was phrased to read as ordinary human-directed business text, which slipped it past Microsoft's Cross-Prompt Injection Attack (XPIA) classifier — the filter expected language aimed at an AI, and the payload never mentioned AI, Copilot, or instructions at all.^[5] Once Copilot ingested the email as context, it was coerced into reaching into internal files and leaking their contents to an attacker-controlled server, using reference-style Markdown and auto-fetched images to smuggle data past link redaction.^[5]

Researchers named the underlying flaw an "LLM Scope Violation": untrusted external input tricking the AI into accessing and revealing privileged internal data without consent.^[5] Microsoft patched it server-side and reported no in-the-wild exploitation,^[4][6] but the lesson outlives the CVE. Traditional defenses — antivirus, firewalls, static file scanning — are blind to this, because the payload is pure natural language and the model is "behaving as designed."^[5] Any LLM assistant that bridges untrusted input and privileged internal data shares the same structural exposure.

GitHub Copilot RCE turned a README into shell access

If EchoLeak was about reading your data, CVE-2025-53773 (CVSS 7.8 HIGH) was about running code on your machine. Disclosed in August 2025 and patched in that month's Patch Tuesday, it affected GitHub Copilot in Visual Studio and Visual Studio Code.^[8]

The mechanism is almost insultingly simple. Copilot could write to workspace files without explicit user approval, and those writes hit disk immediately rather than appearing as a reviewable diff.^[8] An attacker embedded a hostile prompt in a public repo's README.md, source, or GitHub issue. When a developer opened the repo and ran something as innocent as "Review this code," Copilot processed the injected instruction and silently wrote "chat.tools.autoApprove": true into .vscode/settings.json — flipping on the notorious "YOLO mode" that disables confirmation prompts.^[8] From there Copilot could run arbitrary shell commands across Windows, macOS, and Linux.^[8]

Researchers demonstrated a wormable propagation scenario — a proof-of-concept where the payload self-replicated through git submodules, capable in principle of spreading across repos and CI/CD pipelines, drawing comparison to historical outbreaks like Code Red and SQL Slammer. This was a demonstrated PoC, not reported as active in-the-wild exploitation.^[9][10]

Microsoft's fix now requires user approval for security-sensitive config changes.^[7] The root cause, though, was a design default: convenience-by-default instead of secure-by-default let an AI agent escalate its own privileges with no human in the loop.

What this means for e-commerce and AI-assisted shops

If you build on Shopify or WooCommerce and you've bolted an AI assistant onto support, product search, or admin tooling, EchoLeak is your problem too. Any model that reads attacker-controllable text is a scope violation waiting to happen. Concretely:

An AI support bot reads customer messages and order data — a prompt-injected ticket can try to coax it into revealing another customer's order details or account information.
An AI product-feed assistant ingests supplier feeds and scraped product descriptions — untrusted text that can carry hidden instructions straight into your pipeline.
An AI admin assistant with write access can edit products, discounts, or outgoing emails — and a poisoned input could try to drive those actions without an operator's intent.
A single prompt-injected support ticket can attempt to make the bot disclose order data or perform admin operations it was never meant to take on a customer's say-so.

The mitigations are the same ones Microsoft learned the hard way: scope the data the model can reach before it reaches it, label and govern sensitive stores, and never let a model-initiated action touch a destination or operation the user didn't explicitly authorize. The highest-risk pattern is combining three things in the same system: untrusted external content, access to sensitive business data, and the ability to take actions without human approval.

Key Takeaways

Prompt injection is OWASP LLM01:2025 — the top-ranked LLM application risk, with no complete fix and published attack success rates ranging from roughly 50% to 84% under specific testing conditions.^[2]
Indirect injection (payloads hidden in documents, emails, web pages, and code the model reads) is the vector behind nearly every serious 2025 incident — not the obvious "ignore your instructions" user prompt.
EchoLeak (CVE-2025-32711) showed zero-click exfiltration from a production LLM is practical, defeating a dedicated injection classifier with plain business language.^[4][6]
CVE-2025-53773 escalated prompt injection into local code execution by abusing an AI agent's ability to alter security-sensitive configuration. Researchers demonstrated how this pattern could become wormable across repositories, but the public record does not show confirmed in-the-wild exploitation.^[8][9]
Defense is layered, not singular: treat all model-read content as untrusted, enforce scoped data access and privilege separation, sandbox outputs, and demand human approval for side-effectful actions.

Why prompt injection is different from traditional injection attacks

Every other injection class we know how to contain — SQL injection, command injection, XSS — shares one property: a definable boundary between code and data. Parameterize the query, escape the input, sanitize the markup, and the trusted instruction stays trusted. That boundary is the entire basis of the defense.

Prompt injection breaks because that boundary does not exist inside a language model. The system prompt, the user's request, and a malicious string lifted from a web page all arrive as the same flat sequence of tokens, and the model resolves what to obey by meaning — precisely the thing an attacker writes. There is no escaping function for natural language. You cannot "parameterize" intent.

This is why indirect prompt injection, formally introduced by Greshake et al. in 2023, reframed the whole threat model: any application that feeds external content into an LLM has effectively handed the keyboard to whoever authored that content.^[11] The trust boundary that traditional application security depends on has quietly dissolved — and that dissolution, not any single CVE, is the real story. EchoLeak and CVE-2025-53773 are just the first two hands dealt off that deck.

FAQ

What is the difference between prompt injection and jailbreaking?
Jailbreaking aims to make a model violate its own safety policies (produce disallowed content). Prompt injection aims to override the developer's instructions to hijack the application's behavior — leaking data, taking actions, or misusing tools. They overlap technically but have different goals.

Can prompt injection be fully patched?
No. Because the model can't structurally separate trusted instructions from untrusted data, there's no single fix. Even frontier models remain vulnerable after applying best-effort defenses, which is why OWASP and researchers recommend defense in depth rather than a silver bullet.^[2]

Is prompt injection only a chatbot problem?
No — it's worse in agentic systems. The moment a model can read external content and take actions (run code, send email, change files), indirect injection can escalate from data leakage into code execution when an agent is able to modify configuration or invoke tools, as demonstrated by CVE-2025-53773.^[9]

How do I defend a production LLM app today?
Scope and label the data the model can access before it reaches the model, isolate untrusted input from system instructions, sandbox tool outputs, log model-initiated actions, and require explicit user approval for anything irreversible or security-sensitive.

Was EchoLeak exploited in the wild?
Microsoft reported no evidence of malicious exploitation and patched it server-side. Its significance is as a proof of concept that the attack class is practical against real production systems.^[4]