The problem space · Context · Prompt injection
Align your AI Context against prompt injection
Any email or web page an assistant reads can carry hidden orders that it then follows.
- Context
- what it reads before it answers
- Prompt injection
- orders hidden in what it reads
Ways it goes wrong
An assistant cannot reliably tell the text it should read from orders it should follow. So any email or page it reads can carry orders. In both cases below, the attacker only had to put text where the assistant would read it12.
2025
EchoLeak in Microsoft 365 Copilot
A single crafted email could make Microsoft's Copilot assistant for office work send data out of the user's account without the user clicking anything.
Source: arxiv.org/abs/2509.10540
2025
Perplexity Comet and a Reddit comment
Researchers hid instructions in a Reddit comment; asked to summarize the page, Perplexity's Comet browser fetched the user's email address and a login code and posted them back.
What people do about it
Brave's researchers recommend separating the user's instructions from page content and asking before sensitive actions2. The EchoLeak case study recommends least privilege and splitting trusted from untrusted input1.
Keep instructions and content apart
Passes the user's request and the page or email text to the model as separate inputs, and treats the content as untrusted.
Ask before sensitive actions
Requires the user to confirm before an assistant sends mail, shares data or signs in.
Red-team with planted instructions
Hides instructions in test pages and documents and checks whether the assistant follows them.
Resource: Promptfoo
Where we touch it
No study of ours covers this pair yet.
Sources
-
Reddy and Gujral, case study of EchoLeak (CVE-2025-32711) in Microsoft 365 Copilot, arXiv 2509.10540. https://arxiv.org/abs/2509.10540. Accessed 2026-10-14. ↩ ↩2
-
Brave, “Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet”, 2025-08-20. https://brave.com/blog/comet-prompt-injection/. Accessed 2026-10-14. ↩ ↩2