EchoLeak: a single crafted email could make Microsoft 365 Copilot leak internal data
Aim Labs researchers showed that an email with hidden instructions, phrased as if written for a human, could make Microsoft 365 Copilot pull sensitive data from the user's context and send it to an attacker without the user clicking anything. The chain bypassed Microsoft's cross-prompt-injection classifier and link redaction, and abused a Microsoft Teams URL allowed by Copilot's content security policy. Microsoft assigned CVE-2025-32711, rated it critical and fixed it server-side, saying there was no evidence of real-world exploitation.
The researchers devised the attack in January 2025 and reported it to Microsoft, which fixed it in May before public disclosure on 11 June 2025. Exfiltration relied on markdown images that the browser fetches automatically, carrying the data in the URL.
What would have stopped it
Treat retrieved external content as data, never as instructions, and block model-generated requests to untrusted hosts.
Guardrails
- G1 Least privilege Not assessed Did the agent hold only the access the task needed?
- G2 Human confirmation Failed The leak needed no user action; auto-fetched images carried the data out.
- G3 Isolation Partial The content security policy blocked most domains but trusted a Microsoft Teams URL that relayed data.
- G4 Instruction integrity Failed Copilot followed instructions in an external email after they slipped past the XPIA classifier.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“The flaw, revealed today by AI security startup Aim Security and shared exclusively in advance with Fortune, is the first known “zero-click” attack on an AI agent, an AI that acts autonomously to achieve specific goals.”
-
“The tech giant assigned the CVE-2025-32711 identifier to the information disclosure flaw, rating it critical, and fixed it server-side in May, so no user action is required.”
-
“This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email.”
Confidence 84% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources