Author(s): Shrashti Singhal

Originally published on Towards AI.

Your agent can’t tell your instructions from an attacker’s. Nobody’s fully fixed that — and the more capable your agent gets, the more that costs you. Part nine of a series on building production AI agents.

In June 2025, security researchers disclosed a vulnerability in Microsoft 365 Copilot that they named EchoLeak. It worked like this: an attacker sends you an ordinary-looking email. You never open it, never click anything, never even read it. But Copilot reads it — because Copilot reads your whole inbox to answer your questions — and hidden inside that email are instructions telling Copilot to gather sensitive data from your other documents and quietly ship it to an external server through an auto-loading image. Zero clicks. The victim does nothing wrong. The agent does exactly what it was told, by the wrong person.

The article argues that prompt injection remains fundamentally unresolved for agentic systems because the model receives both trusted instructions and untrusted attacker content through the same in-band token stream, so it can’t reliably distinguish “friend” from “foe.” It explains why agents amplify risk compared to chatbots: an agent’s outputs are actions with real tools and privileges, creating a “lethal trifecta” where (1) access to private data, (2) exposure to untrusted content, and (3) external communication can combine into data exfiltration. Using incidents like EchoLeak and the GitHub MCP heist, it shows that the most effective fixes are architectural rather than purely model-based—breaking or preventing the trifecta via policy controls, scoped/least-privilege credentials, permission ladders with enforced harness rules, and separating planning from untrusted data (e.g., Dual LLM/CaMeL-style provenance-tagging). It also emphasizes layered defense: classifiers help as a cost-raiser but are never sufficient against adaptive attackers, while tracing/“flight recorder” observability enables detection and forensics. The piece concludes that the path forward is to assume the model will be fooled and to move the security boundary into the surrounding harness and system design—rather than relying on smarter prompts.

Read the full blog for free on Medium.

Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.

Published via Towards AI