Skip to content
Today
Sign in

Published · 5h agoBuild2 min read

Copilot and Muse got patched at the same leg of the lethal trifecta

Simon Willison's three ingredients for stealing data from an LLM agent fit EchoLeak in Microsoft 365 Copilot and Patrick Wardle's unpatched Muse zero-day, and in each case the repair went to the third one.

3 publishersFor you

Written for builders.See today for builders

Artwork accompanying Copilot and Muse got patched at the same leg of the lethal trifecta
Photo: simonwillison.net

What happened

  • Simon Willison set out three capabilities whose combination lets an attacker steal data from an agent: access to private data, exposure to untrusted content, and a way to communicate externally.
  • EchoLeak, filed as CVE-2025-32711, was a zero-click prompt injection in Microsoft 365 Copilot that allowed remote, unauthenticated data exfiltration from a single crafted email.
  • Meta shipped a hotfix that stripped the internal debugging preference key from production Muse builds, so the dictation destination can no longer be changed locally.

Compiled by The EngineerSomething wrong?How this is made

Why it matters

  • constraint The trifecta is only a vendor's problem while a vendor owns all three legs; Willison's warning is that a user who assembles tools from different sources has nobody left to lock down the exfiltration vector.
  • exposure Owners routinely hand an agent broad macOS permissions, so an attacker who steers the signed assistant inherits its reach into files, calendars and mail without writing infostealer malware.
  • contradiction Meta scopes the Muse flaw as needing prior code execution, while the practitioners quoted by InfoQ treat that prerequisite as cheap and the TCC bypass it buys as the hard-won part.
  • precedent Because fixes close outbound channels and leave instruction-following intact, every new link, image fetch or allowed proxy an assistant gains reopens the same vulnerability.

Only one of the three capabilities is repairable at the vendor's end. Willison wrote of the exfiltration cases he has collected: "Almost all of these were promptly fixed by the vendors, usually by locking down the exfiltration vector such that malicious instructions no longer had a way to extract any data that they had stolen" [3]. The first two legs stay where they are because of how the input is assembled. "LLMs are unable to reliably distinguish the importance of instructions based on where they came from. Everything eventually gets glued together into a sequence of tokens and fed to the model," he wrote [2].

The EchoLeak email evaded Microsoft's XPIA cross-prompt-injection classifier, used reference-style Markdown to get around link redaction, relied on images the client fetches automatically, and moved the data through a Microsoft Teams proxy the content security policy already permitted [9]. That is what closing the third leg costs. The hidden instructions had Copilot embed the most sensitive details from the user's context in an outbound reference link [12]. Microsoft assigned CVE-2025-32711 and issued emergency patches [10].

Meta's Muse client fails the same test one layer down. An undocumented preference key, endo_voyager_dictation_endpoint, names the server that receives dictation audio, and an unprivileged local process can overwrite it with no admin rights and no operating system prompt [15]. On dictation the client sends raw microphone audio and the account's valid authentication token to whatever endpoint is set. Wardle demonstrated a proxy that captured both while forwarding traffic to Meta so nothing looked amiss [16]. Holding the pipeline, an attacker can append hidden instructions to a voice request and have the assistant pull local documents or WhatsApp message histories [17]. Meta's hotfix stripped the debug key from production builds [19].

David Singleton of Meta Superintelligence Labs framed the flaw as a local configuration problem requiring prior code execution, according to InfoQ. InfoQ also reports that security professionals commenting on the disclosure rejected that reading: ClickFix-style lures trivialise initial access, while bypassing Apple's Transparency, Consent, and Control framework is traditionally complex [20][21]. Both remediations sit on the outbound path [25].

Willison's own tally comes to seventeen named systems since April 2023 [6]. The test that transfers is the three-part one. What no vendor can close is the composition: a user who assembles tools from different sources has nobody locking down the exfiltration vector for them [7].

What to watch

  • Whether Meta issues an advisory or CVE for the Muse flaw or keeps handling it as an internal configuration defect.
  • Whether other Muse preference keys remain writable by unprivileged local processes after the hotfix.
  • Whether Amazon's block on Muse over automated agent access policies is matched by other platforms.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Willison's lethal trifecta for AI agents is access to your private data, exposure to untrusted content, and the ability to communicate externally in a way that could be used to steal data; if an agent combines all three, an attacker can trick it into sending private data to the attacker.

    ReportedSource: Simon Willison, simonwillison.net, 16 June 2025View cited source
  2. [2]

    "LLMs are unable to reliably distinguish the importance of instructions based on where they came from. Everything eventually gets glued together into a sequence of tokens and fed to the model."

    ReportedSource: Simon Willison, writtenView cited source
  3. [3]

    "Almost all of these were promptly fixed by the vendors, usually by locking down the exfiltration vector such that malicious instructions no longer had a way to extract any data that they had stolen."

    ReportedSource: Simon Willison, writtenView cited source

Sources & coverage · 3 publishers

The reporting this story was synthesized from, earliest first. Every link goes to the original.

  1. infoq.com6h ago
    Un-Mused: How a Single Debug Setting Bypassed macOS Security in Meta’s AI Client
  2. simonwillison.net
    private data, untrusted content, and external communication

    Cited in this coverage: Simon Willison, simonwillison.net, 16 June 2025

  3. arxiv.org
    The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Additional citations

  • Simon Willison, written
  • InfoQ