EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

A preprint on EchoLeak, which its title calls the first real-world zero-click prompt injection exploit in a production LLM system. Both papers cite its June 2025 finding that a single unopened email, written by a person, could make Microsoft 365 Copilot send its recipient's data to an attacker. It is the founding case of parasites of agents: every agent with authority is a potential host.

Cited in

both papers (Flagship: Who feeds on whom, Fig. 1; Companion §4, Fig. 1)

Used for

Food web (parasites of agents); Fig. 1

Strand

Cybersecurity & AI-enabled attack · Prompt injection, agent worms & supply-chain parasites

Cite

@misc{reddy2025echoleak,
  title = {EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System},
  author = {Pavan Reddy and Aditya Sanjay Gujral},
  year = {2025},
  url = {https://arxiv.org/abs/2509.10540},
}