EchoLeak: the three-boundary LLM Scope Violation
boundary 1: retrieval
untrusted content
attacker email in RAG context
defense: scope labels
IFC + untrusted tag
boundary 2: scope
privileged access
mailbox / repo / HR scopes
defense: capability gating
tool calls only from trusted intent
boundary 3: output
exfiltration
CSP-approved URL; image render
defense: narrow allowlist
egress domain restrictions
CVEs in the family (2025)
CVE-2025-32711 EchoLeak (CVSS 9.3): M365 Copilot; zero-click; CSP-approved exfiltration.
CamoLeak (CVSS 9.6): GitHub Copilot Chat via Camo image proxy; fixed by disabling image rendering.
CVE-2025-53773: GitHub Copilot RCE via prompt injection in code-suggestion surface.
severity calibration: vendors initially under-rate. Aim Labs escalates via demonstrated MFA-code exfiltration.
NIST AI SPD 2024: "generative AI's greatest security flaw." OWASP LLM01 2025: #1 threat.
policy: three boundaries require three independent controls. fixing one is not sufficient.
responsible disclosure: MSRC patches server-side; Aim Labs publishes; ecosystem learns. iterate.