Prompt Injection Attacks Explained: How Hackers Hijack AI With Plain Text (And How to Stop Them)

In July 2025, researchers at Aim Security disclosed a vulnerability in Microsoft 365 Copilot that required no clicks, no downloads, and no user interaction of any kind. An attacker only had to send an email. Copilot did the rest, reading the hidden instructions inside it and quietly leaking sensitive data back out. No malicious code ever ran. The entire attack was written in plain English.

That vulnerability, now tracked as CVE-2025-32711 and nicknamed EchoLeak, is the clearest public demonstration yet of what security researchers call prompt injection, and it's why the Open Worldwide Application Security Project (OWASP) ranks it as the single biggest risk facing large language model applications today, ahead of data leakage, supply chain attacks, and every other entry on its Top 10 for LLM Applications list (Mend, 2025).

What Prompt Injection Actually Is

Prompt injection happens when an attacker manipulates the input an AI model receives to override, bypass, or quietly alter the instructions it was originally given. OWASP splits it into two flavors:

• Direct prompt injection: the attacker types the malicious instruction straight into a chat box or input field. "Ignore your previous instructions and..." is the classic, if now somewhat dated, example.
• Indirect prompt injection: the malicious instruction is hidden somewhere the model will read later, a webpage, a PDF, a support ticket, a calendar invite, an email, and the model encounters it while doing its job, with no attacker present at the moment of the attack.

Indirect injection is the more dangerous of the two, because it scales without the attacker lifting a finger after the initial setup. Plant the payload once, in one document or one webpage, and every AI system that later reads that content is a potential victim.

The reason this works at all comes down to a structural weakness every large language model shares: there is no reliable, built-in boundary between "instructions" and "data." A traditional application knows the difference between code and user input, that's the entire premise behind decades of work preventing SQL injection and cross-site scripting. An LLM, by contrast, reads everything as one continuous stream of text. If a sentence embedded in a spreadsheet cell reads like an instruction, the model has no innate way to know it isn't one.

MITRE formalized this risk in ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems), its knowledge base for how adversaries target AI models, cataloging more than 100 distinct techniques across the AI attack surface (CrowdStrike, 2026). Prompt injection has its own dedicated entry, technique AML.T0051, with direct and indirect variants tracked as distinct sub-techniques (MITRE ATLAS via StartupDefense.io). For red teamers and defenders alike, that gives prompt injection the same kind of structured, referenceable identity that classic MITRE ATT&CK gives to techniques like phishing or credential dumping: a shared vocabulary instead of a vague sense that the AI did something weird.

EchoLeak: A Zero-Click Attack Hidden in a Word Document

EchoLeak is worth walking through in detail because it shows the full attack chain, not just the injection itself.

The payload lived inside ordinary business documents: hidden text in speaker notes, buried comments, or metadata fields inside Word documents, PowerPoint decks, and Outlook emails. None of it was visible to a human opening the file normally. But Copilot doesn't just read what a person would see. When asked to summarize or analyze a document, it processes everything in it, including the parts designed never to be read by a human at all.

That's the injection. The exfiltration relies on a second trick researchers call prompt reflection: Copilot's own response gets crafted, by the attacker's hidden instructions, to include a reference to an external image. When Copilot's output tries to render that image, the request itself carries the stolen data out, encoded right into the image URL, to a server the attacker controls. As one technical writeup put it plainly: "No code, only words: the payload is pure text, embedded in normal business documents" (Hack The Box, 2025).

Aim Security disclosed the vulnerability responsibly, and Microsoft shipped a server-side fix in July 2025 that required no action from Copilot users at all. But the underlying lesson didn't get patched away: any AI system that reads untrusted documents and can also take actions, summarizing, replying, calling a tool, generating a link, has the same shape of exposure, whichever vendor built it.

Prompt Injection Is Already Loose on the Open Web

EchoLeak targeted a single enterprise product. Researchers at Palo Alto Networks' Unit 42 found something broader: prompt injection payloads already embedded across ordinary public webpages, built to target the AI agents and browsing assistants that increasingly crawl and summarize that content on a user's behalf (Unit 42, Palo Alto Networks). Their framing is blunt: the web itself effectively becomes an LLM prompt delivery mechanism once browsing agents start treating page content as something to act on, not just read.

The documented cases range from mundane to alarming:

• A site hosting fraudulent "military glasses" ads hid the word "APPROVED" repeated dozens of times inside invisible HTML elements, an attempt to trick AI-powered ad review systems into rubber-stamping the listing.
• A phishing page impersonating a betting platform planted manipulative footer text aimed squarely at AI search engines, trying to get an assistant to recommend the malicious link to a human user.
• Hidden instructions attempted to push AI shopping or finance agents into unauthorized actions, including a $5,000 PayPal transfer and forced subscription upgrades via crafted OAuth redirect links.
• Some payloads went straight for destruction: instructions telling an agent to delete a database or run a fork bomb capable of crashing the machine it was running on.

Unit 42's dataset also quantifies how these attacks are actually built in practice: 85.2% relied on social engineering as their core jailbreak technique rather than any exotic technical trick, and the payloads were split fairly evenly between plain visible text (37.8%) and content hidden through HTML attribute cloaking (19.8%). Over 73% of the identified pages were hosted on ordinary .com domains, nothing exotic about the infrastructure at all.

The pattern across both EchoLeak and the Unit 42 findings is the same: the attack doesn't need to be sophisticated. It needs the AI system to read something it shouldn't have trusted, and act on it.

How to Detect Prompt Injection

Because the payload is just text, traditional malware detection is close to useless here. There's no signature to match, no binary to sandbox. Detection has to happen at the level of behavior and content, not files. Microsoft's own security guidance for defending Copilot and similar systems lays out the current best practice, and it starts from an uncomfortable assumption: indirect prompt injection will happen, so detection has to assume some attempts will get through the first layer (Microsoft Learn).

Practical detection techniques worth building into any AI deployment:

• Prompt shields: an automated layer that scans incoming prompts and retrieved content for known injection patterns before they ever reach the model.
• Plan drift detection: for agents that reason across multiple steps, watching for the moment a task quietly diverges from its original goal, often the first visible sign an injected instruction has taken hold.
• Critic agents: a second model (or process) whose only job is to review the first model's inputs and outputs for anything that looks off, especially valuable in multi-agent systems where one compromised step can cascade.
• Tool chain analysis: flagging unusual sequences of tool calls. An agent that suddenly tries to read a password file right after summarizing an email is a pattern worth catching automatically, not after the fact.
• Logging and monitoring: treating prompts and model outputs as a real telemetry source, not an afterthought, so a security team can retroactively spot the pattern across an entire fleet of AI-driven tools.

How to Mitigate Prompt Injection

Detection catches attempts. Mitigation limits what a successful one can actually do, and that's where the real risk reduction happens. The consistent advice from OWASP, Microsoft, and the researchers tracking this space converges on a handful of concrete practices:

• Treat all external content as untrusted, always. Anything an LLM retrieves, a webpage, a document, a ticket, a search result, should be handled with the same suspicion a web application gives user-submitted form data. It is data. It is never an instruction, no matter how it's phrased.
• Separate instructions from content structurally, not just by hoping the model behaves. Microsoft calls this spotlighting: using data marking and metaprompting to make it explicit, at the architecture level, which parts of a prompt are trusted system instructions and which are untrusted external content the model should reference but never obey.
• Apply the principle of least privilege to every tool and API an AI system can call. If an agent doesn't need to send money, delete files, or send email on someone's behalf, it shouldn't have standing access to do so. Short-lived, task-scoped permissions limit the blast radius of a successful injection dramatically.
• Keep a human in the loop for anything consequential. Financial transactions, irreversible deletions, and external communications sent on a user's behalf are exactly the actions a prompt injection attack is built to trigger. Requiring explicit human approval before those actions execute is a blunt but effective backstop.
• Build in defense-in-depth, not a single filter. No individual mitigation catches everything. Microsoft's own guidance is explicit that this is a layered problem: probabilistic detection, like prompt shields, paired with deterministic controls, like tool permissions and human approval, so that a single bypass doesn't equal a full compromise.

None of this makes prompt injection disappear. It's a structural property of how language models process text, not a bug that gets patched once and forgotten. But the organizations getting this right aren't the ones waiting for a perfect filter. They're the ones assuming an injection attempt will eventually succeed, and designing every AI-connected system so that a successful injection is an inconvenience, not an incident.

That's also, not coincidentally, the same mindset RogueTrace's own research and bounty campaigns are built around: assume the attacker gets in, and make sure someone's watching for exactly the pattern that means they did.