Prompt injection: when data becomes instructions
Jun 18th, 2025 by Jesper Kråkhede
This month a vulnerability in an AI assistant for business was published that should make everyone building with AI stop and think. The researchers called it EchoLeak. An attacker could send a crafted email to a user. The user didn´t have to open it. Later, when the user asked the assistant an ordinary question, the assistant read the email as context, followed the hidden instructions in it and leaked internal data. Zero clicks.
Microsoft fixed it on the server side and reported no evidence of exploitation. But the class of problem is here to stay. It is called prompt injection.
The core issue is simple. A language model can´t reliably tell the difference between data and instructions. Everything is text. So when an AI reads an email, a document or a web page, any instruction hidden in that content may be followed, with the permissions of the AI.
What can you do? Limit what each AI can reach. An assistant that can read everything is an assistant that can leak everything. Treat external content as untrusted and keep it apart from sensitive data where possible. Restrict how the AI can send data out: links, images, tool calls and connections to external services. Use sensitivity labels and DLP so the most sensitive data isn´t available to the AI at all. And monitor what the AI does, not just what users do.
It is the oldest lesson in security, in a new form. Never trust input.
In the age of AI, every document is potential code.