Phase 2: Prompt Injection & Jailbreaking · 70 min · Python · Regex · RAG pipelines

Indirect Injection & Cross-Domain Prompt Injection (XPIA)

The most dangerous injection is the one nobody typed.

Hiring signal: EchoLeak (CVE-2025-32711) showed that a single email could silently exfiltrate a Copilot user's data with zero clicks. Companies shipping RAG and email/document-processing agents now explicitly screen for candidates who understand indirect injection well enough to both attack and defend a retrieval pipeline — this is the scenario in the OWASP LLM01 interview assessment almost every AI security req references.

What you will learn

Explain the mechanism of indirect prompt injection and why it's invisible to both the end user and the operator at the moment of exploitation
Describe the EchoLeak (CVE-2025-32711) attack chain and why zero-click LLM exfiltration was possible in a production Microsoft 365 Copilot deployment
Reproduce a markdown/image-based data exfiltration technique and explain why rendering untrusted model output is itself an attack surface
Implement data/instruction separation as the primary structural defense against indirect injection

The Problem

In June 2025, security researchers at Aim Security disclosed EchoLeak (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot. The attack chain required no phishing link, no malicious attachment the user had to open, and no action from the victim at all: an attacker simply sent an email containing text crafted to look like an instruction to Copilot, phrased so Microsoft's XPIA (cross-prompt injection attack) classifier didn't flag it as a command. When the victim later asked Copilot an unrelated question, Copilot's retrieval pipeline pulled that email into context as background material — and followed the embedded instruction, which used Markdown image syntax and Microsoft Teams/SharePoint URLs already trusted by the browser's content-security policy to exfiltrate data from the user's session to an attacker-controlled endpoint. The victim never saw the email. They never clicked anything. The exfiltration happened as a side effect of asking Copilot a normal question.

This is what makes indirect injection categorically more dangerous than the direct injection and jailbreaking covered in lesson 1. Direct injection requires the attacker to be the one typing into the chat — the victim is the attacker, or the attacker needs the victim to paste something. Indirect injection requires only that the attacker's content end up somewhere your system will later retrieve: a document in a shared drive, a web page your agent browses, an email in an inbox it summarizes, a support ticket, a product review, a calendar invite. The attacker never interacts with your system directly. They plant content and wait for your own retrieval pipeline to do the work of bringing it into a position of influence.

Greshake et al. formalized this as Indirect Prompt Injection in their 2023 paper (arXiv:2302.12173), which first demonstrated that any LLM application retrieving content from an attacker-influenced source — web search results, documents, emails — inherits an injection attack surface even when the user's own input is completely benign. Two years later, EchoLeak proved this at production scale against one of the most widely deployed enterprise AI products in the world.

Cross-Domain Prompt Injection (XPIA): the Formal Name for This Attack Class

Microsoft's own security and red-teaming tooling (PyRIT's XPIAOrchestrator) uses the term Cross-Domain (or Cross-Prompt) Injection Attack — XPIA — to describe the exact pattern: the injection crosses a domain boundary between the content source (a document, an email, a web page — a domain the attacker controls) and the execution context (the agent's prompt, where the injected content gains the same influence as a legitimate instruction). The "cross-domain" framing is useful because it generalizes past RAG specifically — it covers any pipeline where content from one trust domain (external, attacker-reachable) flows into another (the model's active context) without a trust boundary in between.

Every one of the following is an instance of XPIA:

Vector	Attacker-controlled surface
RAG document injection	Any document an attacker can get indexed — a wiki page, a PDF upload, a support ticket
Web-browsing agent injection	Any web page the agent visits during a search or browse action
Email/calendar injection	Any email sent to an inbox the agent reads, any calendar invite it parses
Database record injection	Any user-editable field (a product review, a profile bio) that later gets summarized or retrieved
Tool-output injection	A third-party API response the agent treats as trusted, if that API's output can itself be attacker-influenced

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Data Exfiltration via Markdown Rendering — a Concrete Exploit Chain, Data Exfiltration Beyond Images: Leaking the System Prompt and Retrieved Context, Why Data/Instruction Separation Is the Primary Structural Defense, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.