Prompt-Injection.net
ENDE
Incidents & cases - Disclosed vulnerability

EchoLeak - Microsoft 365 Copilot

Disclosed vulnerability (CVE-2025-32711): an attacker-authored email could enter Microsoft 365 Copilot's retrieval context and, in the researchers' demonstration, lead to zero-click disclosure of data in Copilot's scope. Microsoft reported no known exploitation.

By Norbert HofmannPublished: 2026-09-26Last reviewed: 2026-09-26
Record type
Disclosed vulnerability
Disclosed
2025-06-11
Product
Microsoft 365 Copilot
In the wild
No known in-the-wild exploitation
Table of contents

Summary

EchoLeak is the name Aim Labs gave to a vulnerability in Microsoft 365 Copilot that Microsoft tracks as CVE-2025-32711, an information disclosure vulnerability. The researchers showed that content from an external, attacker-authored email could be retrieved into Copilot's context when a user later asked an ordinary work question, and that the resulting answer could carry organizational data out of the tenant without the user clicking anything.

This record is classified as a disclosed vulnerability. It documents a validated flaw and a researcher demonstration. It does not document a confirmed breach or known malicious use against customers.

Classification and evidence status

Stable metadata for this record
FieldValue
Record typeDisclosed vulnerability
Public disclosure2025-06-11
Vendor / productMicrosoft / Microsoft 365 Copilot
Attack classIndirect prompt injection
Delivery vectorEmail - attacker-authored email retrieved into Copilot context
Affected data / capabilitiesOrganizational data reachable by Microsoft 365 Copilot for the victim user
Demonstrated impactPotential unauthorized disclosure of data in Copilot's scope over the network; zero-click exfiltration path in the researchers' demonstration
In-the-wild statusNo known in-the-wild exploitation. Microsoft's public record did not report exploitation.
Remediation statusRemediated by vendor. Microsoft remediated the issue server-side; per the advisory, no customer action was required.
IdentifiersCVE CVE-2025-32711 (Microsoft Security Response Center)
External scoreCVSS v3.1 9.3 Critical - assigned by Microsoft in the CVE record

Affected system and trust path

Microsoft 365 Copilot answers questions using content the signed-in user can access, including mail, files and chats. That retrieval step is where the trust path breaks: an email from any external sender is variable content, yet once retrieved it sits in the same model-visible context as the user's request and the user's internal data.

The affected capability is therefore not the model alone but the combination of broad data access, retrieval of untrusted external content, and an output channel that can reach the network.

High-level attack chain

At a high level, the researchers described this sequence: an attacker sends an email to someone in the target organization; the email is written to look like ordinary business content; later, a user asks Copilot a question that causes the email to be retrieved; the retrieved text influences Copilot's answer; and the answer includes output that causes data from the context to be sent to an attacker-controlled destination when rendered.

According to the researchers, the chain had to get past several existing application-side protections to work. This record intentionally does not describe the bypass techniques, the email wording or the output formats involved.

Demonstrated impact vs observed exploitation

Demonstrated: in a controlled setting, the researchers showed a zero-click path by which data within Copilot's reach could be disclosed to an external party.

Observed against real customers: none reported. Public reporting on Microsoft's advisory said the vulnerability was not known to have been exploited. The model being influenced is not itself the security impact; the impact comes from what the influenced output could reach and transmit.

Enabling control gaps

  • External email was retrieved into the same context as trusted internal data without a strong provenance distinction that downstream controls enforced.
  • Content classifiers aimed at detecting injection-like text could be avoided by text that read as normal business mail, which shows why probabilistic inspection is a layer and not a boundary.
  • Model output could cause network requests to destinations outside the organization, so a data flow from sensitive context to an external sink was possible.
  • Copilot's reach across the user's data meant a single influenced answer could touch a wide range of information.

Vendor and researcher response

Aim Labs reported the issue to Microsoft before publication. Microsoft published CVE-2025-32711 on 2025-06-11, scored it CVSS v3.1 9.3 (Critical) in its own record, and stated that the vulnerability had been fully mitigated on the service side, with no customer action required.

Evidence defenders should retain

  • Records of which items (for example, which emails) were retrieved into an assistant answer, with sender and source identifiers.
  • Rendered output and any URLs or resources the client fetched while displaying an answer.
  • Outbound request logs for assistant clients and proxies, especially requests to unfamiliar domains shortly after an answer.
  • Mail-flow records for inbound external messages that were later retrieved by the assistant.

Defensive lessons

  • Data Provenance: keep external-origin labels on retrieved items and let policy, not the model, decide what that origin may influence.
  • Information Flow Control: treat any output channel that can reach the network as a sink; block flows from sensitive context to unapproved destinations.
  • Input / Content Inspection and Detection: useful signals, but a miss must not grant anything.
  • Least Privilege: limit what an assistant can retrieve for a task to reduce the blast radius of one influenced answer.
  • RAG and Retrieval - How RAG works as an application architecture: the retrieval pipeline, why relevance is not trust, security trimming, provenance, citations and derived state.
  • Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.

Parent topic

Data ProvenanceHow to record, preserve and reconstruct where AI context came from and how it was derived: source and author identity, authoritative metadata outside payload text, transformation lineage and lineage-aware cleanup.Information Flow ControlHow to decide, outside the model, whether data with a particular provenance and classification may move from a specific source through processing steps to a specific sink - across model, context, tool, storage and tenant boundaries.Input / Content InspectionHow to inspect user input and external content for prompt injection risk signals: inspection points, representations, risk-tiered dispositions, failure behavior and metrics. An inspection result is evidence, not a trust or authorization decision.Prompt Injection DetectionHow to detect prompt injection attempts and effects at runtime by correlating content, context, model behavior, plan, tool and enforcement signals. Probabilistic evidence for response and investigation, never authorization or a replacement for deterministic enforcement.Least PrivilegeHow to reduce the size, reach and lifetime of agent authority before any action is evaluated: identities, scopes, tool exposure, data access, JIT elevation, review and revocation readiness.

References

  1. CVE-2025-32711 - M365 Copilot Information Disclosure VulnerabilityMicrosoft Security Response Center · Security advisory · 2025-06-11Reviewed 2026-09-26
  2. EchoLeak: zero-click AI vulnerability in Microsoft 365 CopilotAim Security (Aim Labs) · Researcher disclosure · 2025-06-11Reviewed 2026-09-26
  3. CVE-2025-32711 DetailNIST National Vulnerability Database · Vulnerability recordReviewed 2026-09-26