The 7 mitigations don't prevent injection from being attempted. They do three things:
→ Reduce blast radius — limit what the AI can do if injection succeeds
→ Increase detection — catch injections before or after they cause damage
→ Raise the bar — make successful injection harder and less reliable
EchoLeak was rated CVSS 9.3 partly because Copilot had broad access to the victim's entire M365 environment. M4 (least privilege) applied before deployment would have dramatically reduced what the attacker could exfiltrate — even if the injection itself couldn't be stopped.
1. Constrain model behavior · 2. Define and validate expected output formats · 3. Implement input and output filtering · 4. Enforce privilege control and least privilege access · 5. Require human approval for high-risk actions · 6. Segregate and identify external content · 7. Conduct adversarial testing and attack simulations