EchoLeak: Zero-Click Data Leak in Microsoft 365 Copilot

What to do

1. Take no action for CVE-2025-32711 itself; Microsoft states it is fully mitigated.
2. Apply sensitivity labels and DLP so Copilot respects access boundaries on your most sensitive content.
3. If you build RAG assistants, treat retrieved external content (inbound email, shared docs) as untrusted input and isolate it from privileged data.
4. Filter model output: strip or block external links and auto-loading images, and restrict which domains rendered content can reach.
5. Add indirect prompt injection cases (hidden instructions in email or documents) to your AI red-team tests.

How to check if you are affected or compromised

• No customer-side detection is needed for this CVE; Microsoft reported no evidence of exploitation.
• For your own assistants, log and alert on model responses that contain URLs or image references carrying encoded data to unexpected domains.

What happened#

On June 11, 2025, Microsoft published CVE-2025-32711, an information disclosure flaw in Microsoft 365 Copilot. Microsoft rated it Critical with a CVSS 3.1 score of 9.3. The CVE record describes it as "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network." Researchers at Aim Security found it and named it "EchoLeak".

According to BleepingComputer's account of Aim Labs' research, the attack needs only one email:

1. The attacker sends an ordinary-looking business email with hidden instructions, phrased as if written to a human. That phrasing slipped past Microsoft's XPIA (cross-prompt injection attack) classifier.
2. Later, the victim asks Copilot a routine question. Copilot's retrieval (RAG) engine pulls the attacker's email into the model's context alongside internal data.
3. The injected instructions tell the model to embed sensitive data in a link or image reference. Some markdown image forms make the browser fetch the URL automatically, sending the data out.
4. Copilot's content security policy blocked most external domains but trusted Microsoft Teams and SharePoint URLs, which the chain abused to relay the data.

Aim calls this class an "LLM scope violation": untrusted input steering the model into handling privileged data the sender could never access directly, as The Hacker News summarized. The victim never has to click anything.

Who is affected#

Only Microsoft 365 Copilot, a cloud service. BleepingComputer reports that Aim Labs devised the attack in January 2025 and that Microsoft fixed it server-side in May 2025, before disclosure. There are no versions to patch.

Do you really need to act?#

No, not for this CVE. Microsoft's Security Update Guide record marks it as not exploited and not publicly disclosed at release, with "customer action required" set to false. The FAQ says it "has already been fully mitigated by Microsoft. There is no action for users of this service to take." Microsoft said it found no evidence of real-world exploitation. The CVE is not in CISA's KEV catalog.

The bigger significance is architectural. EchoLeak was an early public demonstration of a zero-click chain against a production AI assistant: injection via content the assistant reads on its own, followed by exfiltration through rendered output. Any assistant that both reads attacker-controllable content and can emit links or images to the user's browser has the same shape of risk. If you build such systems, this is the case study to test against.

What to do now#

1. For Copilot itself, do nothing extra for this CVE.
2. Use sensitivity labels and data loss prevention so Copilot's reach matches what users should actually see. That limits the impact of any future injection bug.
3. If you run your own RAG assistant, tag retrieved external content (inbound email, shared files, tickets) as untrusted, and keep it out of contexts that hold secrets where you can.
4. Post-process model output: block auto-loading images and external links, or allow-list only domains you control. Remember that trusted first-party domains can be abused as relays.
5. Add indirect prompt injection tests, with hidden instructions in emails and documents, to your AI red-team suite.

How to tell if you were hit#

Microsoft reported no exploitation, and the fix shipped before public disclosure, so customer-side hunting is not warranted. For assistants you operate, log model responses that contain URLs or image references, and alert on encoded data going to unexpected domains.

Timeline#

• Jan 2025 — Aim Labs devises the attack and later reports it to Microsoft.
• May 2025 — Microsoft fixes the flaw server-side, per BleepingComputer.
• Jun 11, 2025 — Microsoft publishes CVE-2025-32711, and Aim discloses EchoLeak.

Vulnerability records

• CVE-2025-32711 · Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-32711 M365 Copilot Information Disclosure Vulnerability msrc.microsoft.com
2. Microsoft MSRC Security Update Guide API — CVE-2025-32711 record api.msrc.microsoft.com
3. CVE Program — CVE-2025-32711 record (JSON) cveawg.mitre.org

Coverage and analysis

1. BleepingComputer — Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot bleepingcomputer.com
2. The Hacker News — Zero-click AI vulnerability exposes Microsoft 365 Copilot data thehackernews.com