Incident Overview
On June 11, 2025, Aim Security disclosed a critical zero-click vulnerability, designated CVE-2025-32711 and named EchoLeak, affecting Microsoft 365 Copilot. This flaw allowed an attacker to craft an email that, when processed by the system without requiring the recipient to open it, could induce Microsoft 365 Copilot to extract sensitive data from emails, files, and chat histories. The exfiltrated data was then transmitted through a trusted Microsoft domain, marking the first documented zero-click exfiltration vulnerability with a critical severity rating against a major AI-powered assistant.
The vulnerability exploited a prompt injection technique, enabling attackers to manipulate Copilot’s natural language processing to bypass security policies and retrieve confidential information. This incident underscores the risks associated with AI-driven assistants accessing and processing user data without explicit user interaction.
Microsoft confirmed the vulnerability and implemented a server-side fix prior to public disclosure. The company reported no evidence of active exploitation in the wild, though the flaw was recognized as a significant security concern due to its potential impact on data confidentiality and intellectual property protection.
EchoLeak has since been referenced as a benchmark case for zero-click 'LLM scope violation' attacks and was included in the OWASP 2026 exploit round-up, highlighting its relevance to the broader cybersecurity community.
Possible Root Cause
When a crafted email was received by a user’s Microsoft 365 environment, Copilot would parse the email’s content as part of its routine operations, even if the user never opened or interacted with the message. The malicious payload within the email contained carefully constructed prompts designed to exploit Copilot’s ability to retrieve and summarize data from connected sources, such as Outlook emails, OneDrive files, and Teams chat histories.
The attack bypassed traditional security controls by leveraging Copilot’s trusted access to user data, which was intended for legitimate productivity enhancements. The lack of explicit user interaction meant that conventional email security measures, such as phishing filters or spam detection, were ineffective against this type of attack.
The vulnerability was categorized as a 'prompt injection' flaw, where an attacker manipulates the input provided to an AI system to produce unintended outputs. In this case, the injected prompts were structured to coerce Copilot into retrieving sensitive data and transmitting it to an external domain controlled by the attacker, disguised as a legitimate Microsoft service.
Takeaways
Organizations must implement additional layers of security to prevent unauthorized data extraction, even from trusted AI assistants.
The incident highlights the evolving threat landscape where AI systems, while enhancing productivity, can inadvertently become vectors for data exfiltration. Attackers are increasingly exploiting the trust placed in AI tools to bypass traditional security perimeters, necessitating proactive measures to mitigate such risks.
- Implement strict access controls and least-privilege principles for AI-driven applications, limiting their ability to retrieve or transmit sensitive data without explicit user authorization.
- Regularly audit and update AI system configurations to ensure compliance with security best practices, particularly in areas related to prompt handling and data retrieval policies.
- Stay informed about emerging threats related to AI security, including prompt injection techniques, and collaborate with cybersecurity researchers to share insights and develop defensive strategies.
The inclusion of EchoLeak in the OWASP 2026 round-up signals its importance as a case study for understanding and mitigating LLM-related vulnerabilities. Organizations should treat AI security as a priority, integrating it into broader cybersecurity frameworks to address the unique risks posed by these advanced technologies.