Zero-click evolution, part 2: when the injection learns to spread, and the gap Verno Labs is closing
Part 1 covered EchoLeak, the zero-click prompt injection that got sensitive data out of Microsoft 365 Copilot (CVE-2025-32711) without the victim clicking a link or opening the malicious email [1][6]. That is already a serious finding. But EchoLeak is still one attacker, one victim, one session: the email reaches one victim's Copilot, and only what that session can see is exfiltrated.
EchoLeak was a chain of four steps:
- Classifier bypass. The email was phrased as an ordinary request to the human recipient and never mentioned AI, which slipped past Microsoft's injection classifier.
- Link redaction bypass. Reference-style markdown links got past link redaction.
- Auto-fetch. An image reference that the client auto-fetched removed the last click.
- Policy bypass. A Microsoft Teams preview endpoint on the content-security-policy allow-list then fetched the attacker's URL on Copilot's behalf.
Three separate defenses (the classifier, link redaction and the content security policy) each fell to a modest bypass, and the auto-fetched image turned that into zero-click exfiltration [5][6].
The question we hear most after showing a client that result: what happens once the injection does not stop at one victim because it copies itself?
Figure 1 - EchoLeak's single-victim exfiltration versus Morris II's self-replicating spread.
Beyond Exfiltration: When AI Agents Become Worms
It stops being a leak and starts being a worm. In March 2024, researchers published a proof-of-concept worm, called "Morris II", which showed that adversarial self-replicating prompts embedded in emails can cause a GenAI-powered email assistant that uses retrieval-augmented generation (RAG) to not only exfiltrate data, but also embed the same malicious prompt in its outgoing replies. This propagates the infection to new victims entirely without human involvement [2]. No software bug needed to be exploited, and the demonstration ran against email assistants the researchers built in a test environment, not a production product. The poisoned email sits in the assistant's RAG database, and the payload fires when a later query retrieves it as context [2].
The implications are significant: we are no longer talking only about attacks that steal data from a single victim. We are now looking at attacks that could cascade silently across an entire organization's interconnected AI ecosystem wherever assistants consume each other's output. What amplifies the danger further is the expanding capability of AI agents themselves. As they gain native tools for web browsing, code execution, and financial transactions, a single successful prompt injection no longer just reads your inbox—it can initiate cascading actions across any system the agent is authorized to touch. Simon Willison's "lethal trifecta" [3] (an agent that combines access to private data, exposure to untrusted content, and a way to communicate externally) maps cleanly onto this expansion: every new tool an agent gets can add a private-data source, an untrusted-content channel, or an outbound path, and it only takes completing the set once.
Why Security Training Will Not Save You
Here is the most unsettling reality of this threat vector: you cannot train your employees to avoid this.
For decades, enterprise perimeter defense relied heavily on phishing awareness training. We taught teams to audit URLs, verify senders, and avoid unexpected attachments. But in an AI-driven zero-click attack, the user did absolutely nothing wrong. They did not click anything, and they did not even have to open the email themselves; they only had to use Copilot as they normally do [5]. The vulnerability is not human error. It is an inherent risk of how instruction-following LLMs operate [4].
Today's LLMs process instructions (the user's prompt) and untrusted data (retrieved emails, documents, web content) within the same context window, with no hard boundary between the two [4][7]. Until AI architectures can more rigidly separate trusted user commands from untrusted third-party data streams, any AI platform that ingests external content carries some version of this exposure. While specific manifestations like EchoLeak are actively tracked and patched by vendors upon discovery [1][5], the underlying architectural vulnerability is systemic across the industry. As attackers get more creative, future exploits will not just look to leak emails. They are likely to go after the unintended actions Microsoft already lists, such as phishing from a trusted account or running commands with the user's privileges [4].
What Actually Helps
Training will not close this gap, but it is not true that nothing does. The trick is to stop thinking in terms of catching the bad prompt, and start thinking about limiting what the agent can do once it has been fooled [4]. A few things should be non-negotiable by now. Scope what any single agent session can actually pull in before it is asked to summarize or act on anything — the smaller the blast radius, the less an attacker walks away with even on a good day for them. Put a real gate in front of anything high-impact: sending data out, executing code, moving money. Not a classifier check that can be talked past — an actual step the agent cannot quietly clear on its own. Turn off auto-rendering of remote images and previews anywhere an agent is in the loop; that is the step that made EchoLeak zero-click [5], and it is worth checking whether it is on by default in the tools you run. And log agent tool calls and outbound requests the way you would log a privileged account, since increasingly, the "user" behind an action never clicked anything at all.
The first three of these each break a leg of the trifecta: scoping shrinks the private data in reach, and the approval gate and the controls on rendered images cut the path out.
Figure 2 - Defense-in-depth architecture for autonomous agents.
How This Maps to Continuous Testing
Both cases above surfaced through outside researchers acting on their own initiative: EchoLeak, found by Aim Labs in a production system and reported privately to Microsoft months before it was public [5][6], and Morris II, built in a lab to show the risk before it appeared in the wild. That is the uncomfortable pattern worth sitting with: in both cases the flaw was found by people looking for exactly this class of problem, and in EchoLeak's case the vendor heard about it from outside.
More recently, researchers showed how short the path from a flaw to a working worm can be, even without prompt injection: in September 2026, they disclosed WeWorm, a demonstration worm that spread between WeChat accounts through incoming calls, with no action from the victim. By their account, AI helped find the underlying memory-corruption bug in about two days and build the worm in about one more week [8].
This is the gap continuous adversarial testing is built to close. At Verno Labs, Verno Red runs autonomous attack campaigns against an organization's own AI agents — probing for exactly this shape of vulnerability (an agent holding private data, exposed to untrusted content, with a path to communicate externally) before an outside researcher, or an attacker, finds it first. Findings come back tagged to OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Security, and MITRE ATLAS — with a full attack trace and reproduction steps, not just a severity score. From there, Verno Fix turns a finding into a concrete remediation (e.g., a policy change, a guardrail, a scoping fix) while Verno Guard enforces it at runtime, watching live traffic for the next variant of the same attack.
None of this makes the underlying architectural problem go away entirely. As things stand, LLMs still mix instructions and untrusted data in the same context, and no single product fixes that. What changes is how much an attacker gets away with, and how long the gap stays open before someone catches it. The honest goal is to break at least one leg of the trifecta wherever you can, because an attacker needs all three, and to do it before someone outside your company finds the combination.
References
[1] Microsoft Security Response Center (MSRC). (2025). CVE-2025-32711 – M365 Copilot Information Disclosure Vulnerability. Microsoft Advisory.
[2] Cohen, S., Bitton, R., & Nassi, B. (2024). Here Comes the AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. arXiv:2403.02817 (v1 5 March 2024; v2 30 January 2025).
[3] Willison, S. (2025, June 16). The lethal trifecta for AI agents: private data, untrusted content, and external communication. simonwillison.net.
[4] Paverd, A. Microsoft Security Response Center (MSRC). (2025, July 29). How Microsoft defends against indirect prompt injection attacks. MSRC Blog.
[5] Reddy, P. & Gujral, A. S. (2025). EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. Proceedings of the AAAI Fall Symposium Series, 7(1), 303–311. https://doi.org/10.1609/aaaiss.v7i1.36899 (preprint: arXiv:2509.10540).
[6] Aim Labs. (2025). Breaking down 'EchoLeak', the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot. https://www.catonetworks.com/blog/breaking-down-echoleak/
[7] Zverev, E., et al. (2025). Can LLMs Separate Instructions from Data? And What Do We Even Mean by That? ICLR 2025. arXiv:2403.06833.
[8] Kan, M. (2026, September 8). This AI-Developed Computer Worm Could Have Hijacked a Billion Accounts. PCMag. https://www.pcmag.com/news/this-ai-developed-computer-worm-could-have-hijacked-a-billion-accounts
Part 1 covered EchoLeak, the zero-click prompt injection that got sensitive data out of Microsoft 365 Copilot (CVE-2025-32711) without the victim clicking a link or opening the malicious email [1][6]. That is already a serious finding. But EchoLeak is still one attacker, one victim, one session: the email reaches one victim's Copilot, and only what that session can see is exfiltrated.
EchoLeak was a chain of four steps:
- Classifier bypass. The email was phrased as an ordinary request to the human recipient and never mentioned AI, which slipped past Microsoft's injection classifier.
- Link redaction bypass. Reference-style markdown links got past link redaction.
- Auto-fetch. An image reference that the client auto-fetched removed the last click.
- Policy bypass. A Microsoft Teams preview endpoint on the content-security-policy allow-list then fetched the attacker's URL on Copilot's behalf.
Three separate defenses (the classifier, link redaction and the content security policy) each fell to a modest bypass, and the auto-fetched image turned that into zero-click exfiltration [5][6].
The question we hear most after showing a client that result: what happens once the injection does not stop at one victim because it copies itself?
Figure 1 - EchoLeak's single-victim exfiltration versus Morris II's self-replicating spread.
Beyond Exfiltration: When AI Agents Become Worms
It stops being a leak and starts being a worm. In March 2024, researchers published a proof-of-concept worm, called "Morris II", which showed that adversarial self-replicating prompts embedded in emails can cause a GenAI-powered email assistant that uses retrieval-augmented generation (RAG) to not only exfiltrate data, but also embed the same malicious prompt in its outgoing replies. This propagates the infection to new victims entirely without human involvement [2]. No software bug needed to be exploited, and the demonstration ran against email assistants the researchers built in a test environment, not a production product. The poisoned email sits in the assistant's RAG database, and the payload fires when a later query retrieves it as context [2].
The implications are significant: we are no longer talking only about attacks that steal data from a single victim. We are now looking at attacks that could cascade silently across an entire organization's interconnected AI ecosystem wherever assistants consume each other's output. What amplifies the danger further is the expanding capability of AI agents themselves. As they gain native tools for web browsing, code execution, and financial transactions, a single successful prompt injection no longer just reads your inbox—it can initiate cascading actions across any system the agent is authorized to touch. Simon Willison's "lethal trifecta" [3] (an agent that combines access to private data, exposure to untrusted content, and a way to communicate externally) maps cleanly onto this expansion: every new tool an agent gets can add a private-data source, an untrusted-content channel, or an outbound path, and it only takes completing the set once.
Why Security Training Will Not Save You
Here is the most unsettling reality of this threat vector: you cannot train your employees to avoid this.
For decades, enterprise perimeter defense relied heavily on phishing awareness training. We taught teams to audit URLs, verify senders, and avoid unexpected attachments. But in an AI-driven zero-click attack, the user did absolutely nothing wrong. They did not click anything, and they did not even have to open the email themselves; they only had to use Copilot as they normally do [5]. The vulnerability is not human error. It is an inherent risk of how instruction-following LLMs operate [4].
Today's LLMs process instructions (the user's prompt) and untrusted data (retrieved emails, documents, web content) within the same context window, with no hard boundary between the two [4][7]. Until AI architectures can more rigidly separate trusted user commands from untrusted third-party data streams, any AI platform that ingests external content carries some version of this exposure. While specific manifestations like EchoLeak are actively tracked and patched by vendors upon discovery [1][5], the underlying architectural vulnerability is systemic across the industry. As attackers get more creative, future exploits will not just look to leak emails. They are likely to go after the unintended actions Microsoft already lists, such as phishing from a trusted account or running commands with the user's privileges [4].
What Actually Helps
Training will not close this gap, but it is not true that nothing does. The trick is to stop thinking in terms of catching the bad prompt, and start thinking about limiting what the agent can do once it has been fooled [4]. A few things should be non-negotiable by now. Scope what any single agent session can actually pull in before it is asked to summarize or act on anything — the smaller the blast radius, the less an attacker walks away with even on a good day for them. Put a real gate in front of anything high-impact: sending data out, executing code, moving money. Not a classifier check that can be talked past — an actual step the agent cannot quietly clear on its own. Turn off auto-rendering of remote images and previews anywhere an agent is in the loop; that is the step that made EchoLeak zero-click [5], and it is worth checking whether it is on by default in the tools you run. And log agent tool calls and outbound requests the way you would log a privileged account, since increasingly, the "user" behind an action never clicked anything at all.
The first three of these each break a leg of the trifecta: scoping shrinks the private data in reach, and the approval gate and the controls on rendered images cut the path out.
Figure 2 - Defense-in-depth architecture for autonomous agents.
How This Maps to Continuous Testing
Both cases above surfaced through outside researchers acting on their own initiative: EchoLeak, found by Aim Labs in a production system and reported privately to Microsoft months before it was public [5][6], and Morris II, built in a lab to show the risk before it appeared in the wild. That is the uncomfortable pattern worth sitting with: in both cases the flaw was found by people looking for exactly this class of problem, and in EchoLeak's case the vendor heard about it from outside.
More recently, researchers showed how short the path from a flaw to a working worm can be, even without prompt injection: in September 2026, they disclosed WeWorm, a demonstration worm that spread between WeChat accounts through incoming calls, with no action from the victim. By their account, AI helped find the underlying memory-corruption bug in about two days and build the worm in about one more week [8].
This is the gap continuous adversarial testing is built to close. At Verno Labs, Verno Red runs autonomous attack campaigns against an organization's own AI agents — probing for exactly this shape of vulnerability (an agent holding private data, exposed to untrusted content, with a path to communicate externally) before an outside researcher, or an attacker, finds it first. Findings come back tagged to OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Security, and MITRE ATLAS — with a full attack trace and reproduction steps, not just a severity score. From there, Verno Fix turns a finding into a concrete remediation (e.g., a policy change, a guardrail, a scoping fix) while Verno Guard enforces it at runtime, watching live traffic for the next variant of the same attack.
None of this makes the underlying architectural problem go away entirely. As things stand, LLMs still mix instructions and untrusted data in the same context, and no single product fixes that. What changes is how much an attacker gets away with, and how long the gap stays open before someone catches it. The honest goal is to break at least one leg of the trifecta wherever you can, because an attacker needs all three, and to do it before someone outside your company finds the combination.
References
[1] Microsoft Security Response Center (MSRC). (2025). CVE-2025-32711 – M365 Copilot Information Disclosure Vulnerability. Microsoft Advisory.
[2] Cohen, S., Bitton, R., & Nassi, B. (2024). Here Comes the AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. arXiv:2403.02817 (v1 5 March 2024; v2 30 January 2025).
[3] Willison, S. (2025, June 16). The lethal trifecta for AI agents: private data, untrusted content, and external communication. simonwillison.net.
[4] Paverd, A. Microsoft Security Response Center (MSRC). (2025, July 29). How Microsoft defends against indirect prompt injection attacks. MSRC Blog.
[5] Reddy, P. & Gujral, A. S. (2025). EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. Proceedings of the AAAI Fall Symposium Series, 7(1), 303–311. https://doi.org/10.1609/aaaiss.v7i1.36899 (preprint: arXiv:2509.10540).
[6] Aim Labs. (2025). Breaking down 'EchoLeak', the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot. https://www.catonetworks.com/blog/breaking-down-echoleak/
[7] Zverev, E., et al. (2025). Can LLMs Separate Instructions from Data? And What Do We Even Mean by That? ICLR 2025. arXiv:2403.06833.
[8] Kan, M. (2026, September 8). This AI-Developed Computer Worm Could Have Hijacked a Billion Accounts. PCMag. https://www.pcmag.com/news/this-ai-developed-computer-worm-could-have-hijacked-a-billion-accounts