Reliability starts with separating instruction from content

Want to understand what real security risk looks like in generative AI? This 2025 case is a masterclass.

Researchers at Aim Security found a zero-click vulnerability in Microsoft 365 Copilot, catalogued as CVE-2025-32711, CVSS 9.3. They named it EchoLeak.

The attack required zero clicks from the victim. All it took was a malicious email landing in the inbox. When Copilot later processed that email as part of a user's query, hidden instructions in the body caused the model to pull sensitive data from other internal sources (email, SharePoint, OneDrive, Teams) and embed it in a URL, exfiltrating it to an external server.

What stands out is how it slipped past the defenses. Microsoft's XPIA (Cross-Prompt Injection Attempt) classifier already existed. So did link redaction. The attack bypassed both using specific markdown formatting and an already-allowlisted Teams image proxy, so the traffic looked legitimate.

Microsoft shipped a server-side fix in June 2025, with no user action required and no confirmed real-world exploitation. But the case exposed a structural problem: any AI assistant with access to multiple internal data sources has this same attack surface.

The most interesting technical response Microsoft Research built for this is called Spotlighting. The idea is simple to explain and hard to implement well: the model needs to distinguish user instructions from untrusted external text. It does this three ways: delimiting with a randomized marker, datamarking by inserting a special character between words, or encoding the untrusted text in base64 or ROT13, always paired with a system prompt warning that the text is external.

In tests with GPT-family models, Spotlighting dropped the indirect prompt injection attack success rate from over 50% to under 2%, without hurting task performance. It's now part of Prompt Shields, inside Azure AI Content Safety.

If you work on AI projects that pull from multiple data sources, this is the kind of technical content that should be on your risk radar, not just on the security team's. Agent reliability starts with how it separates instruction from content it's merely processing.