EchoLeak zero-click prompt injection disclosed in Microsoft 365 Copilot

Security researchers at Aim Security disclosed a vulnerability in Microsoft 365 Copilot, dubbed EchoLeak and tracked as CVE-2025-32711, that they said allowed an attacker to exfiltrate sensitive internal data by sending a single crafted email — with no need for the victim to open it, click a link, or take any action at all. Microsoft rated the flaw critical, published an advisory alongside the disclosure, and said it had already deployed a server-side patch requiring no customer action.

The attack chain relied on what Aim Security termed a “scope violation”: when a Copilot user later asked the assistant an unrelated question, the AI would pull the earlier malicious email into its retrieval context and follow hidden instructions embedded in it, none of which the user had seen or approved. Researchers described several layers of evasion needed to make the exfiltration work — bypassing Microsoft’s classifier for detecting cross-prompt injection attempts, evading link redaction by formatting malicious links as reference-style Markdown, exploiting automatic image fetching, and routing stolen data out through a Microsoft Teams proxy that Copilot’s content security policy already allowed. Potentially exposed data included the contents of chat histories, OneDrive files, SharePoint documents and Teams messages within Copilot’s access scope.

Microsoft said it had found no evidence the flaw had been exploited before disclosure. Researchers and outlets covering the case described EchoLeak as the first documented case of prompt injection weaponised into concrete, credential-free data exfiltration in a production AI assistant, rather than a demonstration confined to a lab setting, and it was cited afterwards as a reference case for the broader class of “scope violation” vulnerabilities inherent to retrieval-augmented AI agents with access to multiple internal data sources.