EchoLeak and zero-click AI agent risk: what should teams change?

TL;DR: EchoLeak turned Microsoft 365 Copilot into a zero-click exfiltration path by hiding prompt injection inside routine email content, letting an AI agent leak data without user action, according to Verno Labs. The lesson is that agent access, untrusted input and external communication must be governed together, not treated as separate controls.

Editorial analysis by NHI Mgmt Group, based on content published by Verno Labs: “Zero-click evolution, part 1: what EchoLeak means for AI agents and why we built Verno Red”.

Key questions

Q: What breaks when an AI agent can read private data and send it externally?

A: The agent can become an exfiltration path instead of a productivity layer.

Q: Why are zero-click attacks especially dangerous for AI agents?

A: Zero-click attacks are dangerous because the attacker does not need the user to fail or click anything.

Q: How can security teams tell whether an agent is overreaching its intended workflow?

A: Look for paths where a benign trigger can reach multiple privileged systems, especially when the same thread can read, reason and act.

Practitioner guidance

• Define task-scoped agent authority Limit each AI agent to the smallest viable dataset, action set, and runtime context needed for the specific task it performs.
• Separate untrusted input from executable instructions Treat email, documents, and other external content as hostile by default and prevent hidden markup from sharing the same instruction context as the agent.
• Block autonomous outbound communication paths Require explicit policy checks before an agent can send links, messages, or structured requests outside the controlled workflow.

Bottom line: Zero-click prompt injection turns ordinary content processing into a control problem when an AI agent can both read private data and act on it.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →