2025 Microsoft 365 Copilot "EchoLeak" — zero-click AI data exfiltration (CVE-2025-32711)
Data compromised
Anything reachable in the victim’s Copilot context — mailbox contents, Teams messages, OneDrive and SharePoint files — with no user interaction required. Microsoft fixed the flaw server-side, rated it critical, and said no customer action was needed and it had no evidence of exploitation
Technical writeup
Vendor-confirmed AI vulnerability class — CVE-2025-32711, nicknamed EchoLeak and disclosed in June 2025 by researchers at Aim Security, is described by NVD as an AI command-injection flaw in Microsoft 365 Copilot allowing an unauthenticated attacker to disclose information over a network, scored critical (CVSS 9.3). The attack needed no clicks: an attacker emailed a message containing hidden instructions, and when the user later asked Copilot an unrelated business question, Copilot’s retrieval pulled the malicious content into context and followed it. Because Copilot could reference external images and links, the exfiltration channel was the rendering pipeline itself — data left the tenant inside automatically fetched URLs, bypassing content-security expectations by routing through trusted Microsoft domains. Microsoft remediated server-side, stated that no customers were impacted and no action was required, and researchers positioned the bug as the first practical zero-click prompt-injection chain in a mainstream enterprise assistant. No individual count applies, so recordsAffected stays 0; catalogued because it defines the risk pattern for every retrieval-augmented assistant plugged into corporate mail and document stores.
Root cause
Indirect prompt injection delivered by an ordinary email: Copilot’s retrieval layer pulled attacker instructions into model context (an "LLM scope violation"), and automatically fetched image and link references carried tenant data out to attacker-controlled infrastructure