"Separate and clearly denote untrusted content to limit its influence on user prompts."

Copilot read email content and treated it the same as developer instructions. There was no structural distinction between "content I'm reading" and "commands I should follow." This architectural gap was the attack surface — not any specific code bug. EchoLeak was possible in any system with this same architecture.

The model has no signal that the document content should be treated differently from developer instructions.

This doesn't make injection impossible — but it raises the bar substantially and gives the model an explicit signal about content trust level.

Place known injections inside your document tags. Test with: "ignore previous instructions," subtle role changes, encoded Base64 injections, and non-English injections. All should be treated as data to summarize — not instructions to follow.