The Leak That Needs No Click
One of the sharpest data-theft results against an LLM assistant in 2025 used no malware, no stolen password, and no phishing page. It used one line of markdown.
The model, steered by an instruction hidden in content it was reading, wrote an image into its answer. The image URL pointed at a server the attacker controlled, and the secret it wanted was sitting in the query string. When the chat interface rendered that answer, the user's browser did what browsers do with images: it fetched the URL to display the picture. That fetch carried the secret to the attacker. The user read a normal-looking reply and clicked nothing.
This is the public shape of EchoLeak, reported by Aim Labs against Microsoft 365 Copilot and tracked as CVE-2025-32711. An ordinary email carried a hidden instruction, Copilot ingested it while reading the mailbox for context, gathered internal data, and leaked it through content the client rendered, with no user action at any step. Treat the specifics as the reported account rather than a full internal post-mortem, because vendors do not publish everything.
The lethal trifecta lesson named the third leg of the attack as reaching private data and getting it out. This lesson takes that leg apart. Where does stolen data actually go, and how do you close every exit, given that you have already accepted the model can be turned against you. The honest premise is that is not a solved problem, so the design goal is not to keep the model from being steered. It is to make sure a steered model has nowhere to send what it reaches.