What happened
In January 2025 researchers at Aim Labs, part of Aim Security, found a way to make Microsoft 365 Copilot leak data with a single email. They reported it to the Microsoft Security Response Center. Microsoft fixed it on its own servers in May 2025, so customers had nothing to install. The flaw was published on 11 June 2025 as CVE-2025-32711. The CVE record rates it 9.3 out of 10, which is critical. Microsoft said no customer data was accessed. The researchers named it EchoLeak.
The email
The attack needed one message, sent to anyone in the target organisation. It read like normal business mail addressed to a person. It did not mention Copilot. The instructions inside it were phrased as if for a human reader. That phrasing is how they slipped past Microsoft's classifier for cross-prompt injection, the filter meant to catch text that tries to steer the assistant.
The person never had to open the email. Later they asked Copilot an ordinary work question. To answer, Copilot searched their mail and files and pulled the attacker's message into its context. The instructions then told the model to place internal data inside the address of an image. The browser fetched the image by itself, and the data travelled with the request. Most outside addresses were blocked, so the request went through Microsoft Teams and SharePoint addresses that Copilot was allowed to load. An academic case study published in September 2025 describes the same chain of bypasses.
Why it worked
Copilot treats what it retrieves as context. A message from a stranger sat in the same pile as the user's own documents. The model had no reliable way to tell the user's request from instructions planted by someone else. The person saw nothing at all. They never looked at the email, and the image request ran in the background. BleepingComputer called it a zero-click flaw, because the victim did not have to click anything.
What it cost
Nothing that is known. Microsoft found no sign of abuse, and the fix came before the public disclosure. The case is in this archive because it opened a new path. Until then, an email had to persuade a person. Here, mail that the person ignored could still act once an assistant read it on their behalf.
What would have helped
Microsoft's fix closed this route on its side. The wider lessons are for anyone who connects an assistant to a mailbox. Give the assistant access to as little as it needs. Treat every message from outside the company as untrusted input, including when the assistant is the one reading it.
What a warning inside the message would have shown. Antilure checks each message for hidden instructions aimed at AI assistants, such as white text and tiny fonts, and tells the reader not to let an assistant act on that message. EchoLeak's instructions were phrased as ordinary business prose. The case is a reason to treat every outside message as text an assistant should not obey.
Sources
- CVE-2025-32711, CVE Program record, Microsoft as numbering authority, published 11 June 2025.
- Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot, BleepingComputer, 11 June 2025.
- EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System, Pavan Reddy and Aditya Sanjay Gujral, arXiv, 6 September 2025.