In 2025, security researchers disclosed a flaw in Microsoft (NASDAQ: MSFT) 365 Copilot that required no malware, no stolen password, and not a single click from the victim. A booby-trapped email — carrying instructions hidden in text the recipient would never see — was enough to make the company's AI assistant quietly hand over internal data the next time an employee asked it an ordinary question. Cataloged as CVE-2025-32711 and nicknamed "EchoLeak," the flaw carried a severity score of 9.3 out of 10 and was later described in a research paper as the first real-world zero-click prompt-injection exploit in a production AI system. Microsoft fixed it with a server-side update and said it had found no evidence the flaw was used against real customers.
EchoLeak is the cleanest illustration yet of a weakness that security professionals now rank as the defining vulnerability of the AI era. It is called prompt injection, and it is not a bug in any single product. It is a consequence of how large language models work — and it is spreading through corporate systems just as companies race to hand those models the keys.
A flaw with no clean patch
Conventional software keeps commands and data in separate lanes: a program's code is one thing, the file it opens is another. A language model collapses that distinction. It reads its instructions and the material it has been asked to work on through the same channel, in ordinary language, with no dependable way to tell an order from a piece of content. So a sentence buried in a web page, a PDF, a calendar invite or a code comment can be read by the model as a fresh command — a technique researchers call indirect prompt injection, because the attacker never talks to the model directly.
That is why the flaw has proven so stubborn. The Open Worldwide Application Security Project, whose risk rankings are a standard reference for security teams, has listed prompt injection as the number-one risk to LLM applications for two editions running. In June 2026 the group reported that the technique now maps to six of the ten categories in its separate Top 10 for agentic systems. Unlike a memory-corruption bug, there is no single fix that closes it; defenses lower the odds without eliminating the class.
Why agents raise the stakes
A chatbot that only produces text can be tricked into saying something wrong. An agent that can send email, query a database, edit files or call an outside service can be tricked into doing something wrong. In June 2025, software engineer Simon Willison named the danger the "lethal trifecta": any AI system that combines access to private data, exposure to untrusted content, and the ability to communicate with the outside world can be turned, with one poisoned input, into a machine that reads secrets and ships them to an attacker. Most genuinely useful enterprise agents are built with all three.
The rush the numbers describe
Companies are adopting agents faster than they are securing them. In a 2026 survey by the identity-security firm SailPoint (NASDAQ: SAIL), 82 percent of organizations said they already use AI agents, and 96 percent called them a growing security threat — yet only 44 percent had policies in place to govern them. Eighty percent said their agents had already taken unintended actions, such as reaching systems or sharing data they should not have, and nearly a quarter reported agents being tricked into revealing access credentials.
Analysts expect the gap to bite. Gartner (NYSE: IT) projects that by 2028, 25 percent of enterprise generative-AI applications will suffer at least five minor security incidents a year, up from 9 percent in 2025 — a rise the firm ties in part to new attack surfaces created by technologies such as the Model Context Protocol, the emerging standard for connecting agents to outside tools and data. Gartner separately predicts that AI-related issues will drive half of all cybersecurity incident-response work by 2028.
When the agent becomes the attacker
The same autonomy cuts both ways. In November 2025, Anthropic (privately held) reported that it had disrupted what it called the first documented AI-orchestrated cyber-espionage campaign: a Chinese state-linked group had jailbroken the company's Claude Code agent — convincing it that it was performing sanctioned defensive testing — and pointed it at roughly 30 corporations and government agencies. Anthropic estimated the AI executed 80 to 90 percent of the operation on its own, from reconnaissance through data theft, with human operators intervening only at a handful of decision points.
That campaign was prompt injection running in the opposite direction: not subverting a company's own assistant, but conscripting a commercial agent into an attack. In both cases the underlying failure is identical — a model that cannot reliably distinguish the instructions it should obey from the ones an adversary slipped into its field of view.
What defense looks like
There is broad agreement on the shape of the response and little pretense that it is simple. Security teams are being told to treat everything an agent reads as untrusted input, to grant agents the narrowest set of permissions that will do the job, to require human approval before an agent takes a consequential action, and to break the lethal trifecta wherever possible — an agent that handles sensitive data should not also be free to read arbitrary web content and message the outside world. Automated guardrails help but are not proof against a determined attacker: EchoLeak succeeded partly by slipping past Microsoft's own prompt-injection classifier, the very system meant to catch it.
The technology industry has spent two years marveling at what AI agents can do. The harder question — the one EchoLeak and the analyst forecasts put on the table — is what happens when the instructions an agent follows come from someone other than its owner. For now, the most valuable thing a company can give an agent is also the most dangerous: the power to act.