黑客通过一封邮件即可窃取企业数据，暴露大模型系统严重安全漏洞。
EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System
- 利用邮件中特殊格式绕过多重防护，实现零点击攻击。
- 可跨系统越权访问，无需用户操作即可泄露全部数据。
- 适合关注AI安全、企业部署的开发者与安全人员阅读。
大型语言模型助手正广泛融入企业工作流，但其连接内外部数据源的特性带来了新的安全风险。本文深入分析了微软365 Copilot中的一个零点击提示注入漏洞（EchoLeak，CVE-2025-32711），该漏洞可通过单封精心构造的电子邮件实现远程、未认证的数据外泄。攻击者通过组合多个绕过技术——包括规避微软XPIA（跨提示注入尝试）分类器、利用引用式Markdown绕过链接过滤、触发自动加载图片、滥用内容安全策略允许的Microsoft Teams代理——实现了在无用户交互的情况下跨越大模型信任边界完成权限提升。我们分析了现有防御失效的原因，并提出一系列工程缓解措施：提示分段、增强输入输出过滤、基于来源的访问控制及严格的内容安全策略。本研究不仅揭示了提示注入在生产级AI系统中的实际危害，更提供了构建安全AI协作者的通用原则，强调最小权限、纵深防御与持续对抗测试的重要性。研究确立了提示注入作为高危漏洞类别在生产环境中的现实威胁，并为应对未来原生AI攻击提供蓝图。
原文摘要 · Abstract (English)
Large language model (LLM) assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources. This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email. By chaining multiple bypasses-evading Microsofts XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy-EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction. We analyze why existing defenses failed, and outline a set of engineering mitigations including prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies. Beyond the specific exploit, we derive generalizable lessons for building secure AI copilots, emphasizing the principle of least privilege, defense-in-depth architectures, and continuous adversarial testing. Our findings establish prompt injection as a practical, high-severity vulnerability class in production AI systems and provide a blueprint for defending against future AI-native threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。