Nearly every AI assistant with work data was shown open to prompt injection: 15 cases

In 2024–2025 security researchers showed prompt injection in nearly every major assistant wired into work data. The list includes Microsoft 365 Copilot, Slack AI, GitHub’s MCP server, GitLab Duo, GitHub Copilot Chat, Salesforce Agentforce, Gemini for Workspace, Perplexity’s Comet browser and ChatGPT’s memory. The script was the same each time: the attacker puts text where the agent will read it, and the agent follows it with the user’s rights.

This article is a registry of 15 documented cases: the vector, what leaked and how the vendor closed it. At the end is a checklist for anyone about to connect an agent to mail, code or a CRM. One caveat up front: almost all of these are responsible disclosures by researchers; confirmed attacks on customers are not reported.

01 · One email was enough for Microsoft 365 Copilot

In June 2025 Aim Labs disclosed EchoLeak. The attacker sends an ordinary email to the victim. Later the user asks Copilot about their own work, Copilot pulls that email into context, follows the instructions hidden in it and moves data out of the Microsoft 365 context. The user does not click anything.

“As the first known zero-click AI vulnerability, EchoLeak opens up incredible opportunities for data exfiltration and extortion attacks for motivated threat actors.” — Aim Labs

Microsoft assigned CVE-2025-32711 and rated it 9.3 (critical); NVD’s own score is 7.5. The fix was made on the service side. Aim Labs added that it was “not aware of any customers being impacted to date”. “First zero-click” is the researchers’ claim: SpAIware and the Slack AI case had shown exfiltration without user action earlier, under other conditions.

02 · The registry: 15 cases disclosed 2024–2026

EchoLeak is one row of a longer table. Each row below is a disclosed case with a primary source.

#	Case	Date	Where the instruction came from	What could leak or happen	How it was closed
1	Slack AI (PromptArmor)	Aug 2024	Message in a public channel	API key from a private channel	Slack: access to public channels is “intended behavior”
2	ChatGPT memory, SpAIware	Sep 2024	Web page or document	Everything the user types, across sessions	Exfiltration channel closed; memory writes still possible
3	MCP tool poisoning (Invariant)	Apr 2025	Tool description of an MCP server	Keys, redirected emails (Cursor demo)	Class of attack, no single patch
4	GitLab Duo (Legit)	May 2025	Hidden comment in a merge request	Private source code	GitLab patched
5	GitHub MCP (Invariant)	May 2025	Issue in a public repository	Private repositories, via a public pull request	Researchers: not fixable server-side
6	Microsoft 365 Copilot, EchoLeak	Jun 2025	Email	Data from the M365 context	CVE-2025-32711, service-side fix
7	GitHub Copilot Chat, CamoLeak	Jun 2025	Comment in code	Secrets and private code	Image rendering disabled
8	Supabase MCP + Cursor	Jul 2025	Customer support ticket	Secret tokens from a closed table	Demo; depends on the assistant’s database role
9	Amazon Q Developer 1.84.0	Jul 2025	Malicious commit into the extension repo	Shipped in a release, did not execute	Version pulled, 1.85.0 issued
10	Perplexity Comet (Brave)	Jul–Aug 2025	Text on a web page or Reddit comment	User’s email in logged-in sessions	Fixed on the second attempt
11	Gemini + Google Calendar (SafeBreach)	Aug 2025	Calendar invite	Data, smart-home control, video stream	Reported Feb 2025; Google published defences Jun 2025
12	Claude in Chrome (Anthropic)	Aug 2025	Email “from security”	Emails deleted without confirmation	Pre-launch test; 23.6% → 11.2%
13	Salesforce Agentforce, ForcedLeak	Jul–Sep 2025	Web-to-Lead form	CRM data	Trusted URLs enforcement from 8 Sep 2025
14	ChatGPT Atlas (OpenAI)	Dec 2025	Email in the inbox	Resignation letter sent instead of an out-of-office	Internal red team; scenario closed
15	First reported malicious injection against an AI ad review system (Unit 42)	Dec 2025	Web page	Bypass of an AI ad review system	Seen in Unit 42 telemetry

Row 9 differs from the rest: it is a supply-chain attack on the agent itself. AWS’s bulletin says the malicious code “was unsuccessful in executing due to a syntax error”; what the code contained, the bulletin does not say.

03 · Any text the agent reads is an entry point

In 14 of the 15 rows the attacker needs no access to the system at all. Any place the agent reads will do: an email, a public issue, a Slack message, a support ticket, a CRM web form, a code comment, a calendar invite, a web page, the description of a third-party MCP tool.

Then three things happen:

1. The model mixes instructions and data. Brave on Comet: the browser feeds the page to the model “without distinguishing between the user’s instructions and untrusted content from the webpage”.
2. The agent acts with the user’s rights. In the Supabase demo the IDE assistant held the service_role key, which bypasses row-level security. Brave notes that same-origin policy and CORS become “effectively useless” when the agent browses as the user.
3. Data leaves through an ordinary channel. A rendered image, a link, a public pull request, a request to a domain. In ForcedLeak the domain was on Salesforce’s trusted list but had expired; Noma Labs bought it for $5.

The SpAIware case adds a fourth step: the injection writes itself into long-term memory and fires in later sessions.

04 · Three conditions explain every leak

Simon Willison calls the pattern the lethal trifecta: an agent that has access to private data, is exposed to untrusted content and can communicate externally. If all three are present, someone can steal data through it.

Run the table through that filter. EchoLeak: mailbox data, outside email, an outbound link. GitHub MCP: private repos, public issue, pull request. ForcedLeak: CRM records, web form, an HTTP request to a domain. Every row with a data leak has all three. Rows 12 and 14 swap the exit for a destructive action: deleted mail, a resignation letter. Rows 9 and 15 are a different class of attack.

This gives a leader a simple question for any agent project: which of the three can we remove? An agent that reads outside email but cannot send anything anywhere is a much smaller problem.

05 · Vendors close the exit and leave the injection

Look at the “how it was closed” column. GitHub turned off image rendering in Copilot Chat. Salesforce enforced a trusted URL list. OpenAI closed the exfiltration channel for memory, yet according to the researcher “a website or untrusted document can still invoke the memory tool to store arbitrary memories”. Willison’s summary of a dozen earlier cases: almost all “were promptly fixed by the vendors, usually by locking down the exfiltration vector”.

“This is not a flaw in the GitHub MCP server code itself, but rather a fundamental architectural issue that must be addressed at the agent system level.” — Invariant Labs

So a vendor’s patch protects one channel in one product. Your own agent, built on the same models and protocols, has its own channels.

06 · In Anthropic’s test, defences halved attack success

The builders of agents say this openly. OpenAI on ChatGPT Atlas: prompt injection, “much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’”. OWASP: “it is unclear if there are fool-proof methods of prevention”.

Anthropic gives a number. Before launching Claude in Chrome it ran 123 test cases across 29 attack scenarios. Without defences 23.6% of attacks succeeded; with site permissions, action confirmations and classifiers the rate fell to 11.2%. That is half, and still one in nine on the vendor’s own test set.

Willison’s view of filters that catch “95% of attacks”: “in web application security 95% is very much a failing grade”. Vendors bet on layers of defence; Willison bets on breaking the trifecta. Both positions are worth knowing; the second is cheaper to check.

07 · Checklist before you connect an agent

The registry reduces to five questions. Ask them of your team or your vendor before an agent touches mail, code or a CRM:

1. Whose rights does the agent run with? A service role or admin token turns any injection into full access. Start with the narrowest role and read-only.
2. What outside text does it read? Emails, web forms, tickets, issues, web pages, calendar invites, tool descriptions of third-party MCP servers. Each one is an entry point.
3. Where can it send data, and who keeps the list of trusted domains? Rendered images, links, HTTP requests, pull requests, outgoing mail. ForcedLeak shows that an allow-list needs an owner who checks for expired domains.
4. Which actions need a human’s approval? Sending, deleting, paying, publishing. The Anthropic test was an email that made the agent delete mail without confirmation.
5. Where is the action log? Without it you will not know that row 15 happened to you.

Decision rule: if the answers show all three trifecta conditions and no approval on outbound actions, remove one condition before launch. For the product side of the same question, see AI agents in your product.

08 · What this registry does not prove

• Mostly disclosures. Thirteen of the 15 rows are research findings or vendor tests. Row 9 was a real compromise that failed to run; row 15 is the first reported malicious injection against an AI ad review system. No customer harm is reported in the sources. Do not retell them as “hackers stole data through Copilot”.
• Numbers come from the authors’ own methods. 23.6% and 11.2% describe Anthropic’s test set; live traffic may differ. CVSS for CamoLeak (9.6) and ForcedLeak (9.4) is the researchers’ score.
• Most reports come from companies that sell AI security. The vulnerabilities are confirmed by vendors (CVE, bulletins, fixes); claims like “first ever” are marketing.
• The cases are 2024–2025. Attacks seen in the wild only started to appear in telemetry at the end of 2025.

Which of the three conditions would you remove first in your own agent?