In June 2025, researchers at Aim Security disclosed EchoLeak, a chain of flaws in Microsoft 365 Copilot that let an outside attacker pull sensitive data out of an organisation simply by sending an email. Nobody had to click anything. When a user later asked Copilot an ordinary question, Copilot retrieved the attacker's email as context, followed the instructions hidden in it and placed internal data into a link that the user's browser fetched automatically. Microsoft fixed it server-side as CVE-2025-32711 and says no customers were affected. EchoLeak was a vulnerability, not a confirmed breach, but it is the reference case for how an AI assistant working with a user's access can be turned against that user by untrusted content.
Key takeaways
- Aim Labs reported EchoLeak to Microsoft in January 2025. It was fixed and disclosed as CVE-2025-32711, rated critical with a CVSS score of 9.3, on 11 June 2025, about five months later.
- The attack needed only an email to a target mailbox. It chained a bypass of Microsoft's prompt injection classifier, a bypass of link and image redaction, and a Content Security Policy bypass through trusted Microsoft domains.
- Aim calls the core weakness an "LLM Scope Violation": untrusted input making the model reach into trusted data without the user's consent.
- Microsoft says the fix needed no customer action, there was no evidence of exploitation in the wild and no customers were affected.
- The lesson for identity teams: an AI assistant that acts with a user's access is an identity in its own right, and anything it reads can try to steer it.
At a glance
| Organisation | Microsoft (Microsoft 365 Copilot); all Microsoft 365 Copilot tenants were potentially exposed before the fix |
|---|---|
| When | Reported January 2025; server-side fixes April to May 2025; disclosed 11 June 2025 |
| Attacker | None observed. Found and reported by Aim Labs, the research team at Aim Security |
| Entry point | A crafted email sent from outside the organisation, later retrieved by Copilot as context |
| Identities abused | Microsoft 365 Copilot acting with the signed-in user's access to mail, files and chats; no attacker credentials were needed |
| Impact | Potential zero-click exfiltration of data in Copilot's context; no in-the-wild exploitation or customer impact reported |
| Category | LLM and AI platform, Agentic AI and AI agents (vulnerability, no confirmed breach) |
What happened
Microsoft 365 Copilot answers users' questions by retrieving relevant content from their Microsoft 365 environment, such as emails, documents and chats, and passing it to a large language model. This retrieval-augmented generation (RAG) design is what makes Copilot useful. It also means content written by outsiders, such as incoming email, can end up in the same model context as sensitive internal data.
Aim Labs found that it could exploit exactly that. According to Fortune, the team discovered the issue in January 2025 and reported it to the Microsoft Security Response Center. Microsoft attempted a fix in April, further issues were found in May, and the flaw was disclosed on 11 June 2025, about five months after the first report. Microsoft published it as CVE-2025-32711 with the description "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network", and The Hacker News reported a CVSS score of 9.3.
As quoted by The Hacker News, Aim described the result as a set of chains that "allow attackers to automatically exfiltrate sensitive and proprietary information from M365 Copilot context, without the user's awareness, or relying on any specific victim behavior." In its write-up, as quoted by Cato Networks, Aim called it "the first zero-click found in a widely used generative AI product that relies at its core on an AI vulnerability, and does not rely on specific user behavior or restrict the exfiltrated data."
Microsoft told Fortune: "We appreciate Aim for identifying and responsibly reporting this issue so it could be addressed before our customers were impacted. We have already updated our products to mitigate this issue, and no customer action is required. We are also implementing additional defense-in-depth measures to further strengthen our security posture."
Aim co-founder and CTO Adir Gruss put the design problem plainly: "The fact that agents use trusted and untrusted data in the same 'thought process' is the basic design flaw". In September 2025, researchers from George Washington University published an academic analysis describing EchoLeak as "the first known case of a prompt injection being weaponized to cause concrete data exfiltration in a production AI system."
Timeline
| Date | Event |
|---|---|
| January 2025 | Aim Labs discovers the attack chain and reports it to Microsoft. |
| April 2025 | Microsoft attempts an initial fix. |
| May 2025 | Further issues are found and a server-side fix is completed. |
| 11 June 2025 | CVE-2025-32711 published in Microsoft's June update cycle; Aim publishes EchoLeak. |
| September 2025 | Academic case study of EchoLeak published on arXiv. |
How it happened: the identity attack path
- An email from outside. The attacker sends a normal-looking business email to someone in the target organisation. It contains instructions written as if for the human reader, such as guidance on a process, so that it does not look like a prompt injection. No credentials or access are needed.
- Getting past the injection classifier. Microsoft's cross-prompt injection attack (XPIA) classifiers are meant to stop instructions hidden in retrieved content. According to Aim and the arXiv analysis, the phrasing of the email avoided them.
- Making sure Copilot retrieves it. Aim described "RAG spraying": spreading the payload across many topics, or several emails, so that Copilot pulls it into context for a wide range of everyday questions, such as those about onboarding, HR or leave.
- A scope violation. When the user asks Copilot something, the email's instructions tell the model to take the most sensitive information in its context and add it to a URL. Aim defines this as an LLM Scope Violation: untrusted instructions making the model "attend to trusted data in the model's context without the user's explicit consent." The data in reach was whatever Copilot could retrieve for that user, including emails, files and chat history.
- Bypassing link and image redaction. Copilot removed ordinary external Markdown links. Reference-style Markdown links and images were not removed, so an image reference carrying the data survived into the answer.
- Bypassing the Content Security Policy. Browsers fetch images automatically, but Copilot's policy only allowed certain Microsoft domains. Aim used URLs on trusted Microsoft services, a SharePoint embed service and a Microsoft Teams URL preview service, that would in turn fetch an attacker-supplied address. The Teams route needed no user action at all, so the data left as soon as the answer rendered.
Impact
- Actual impact: Microsoft says no customers were affected and it found no evidence of exploitation in the wild.
- Potential impact: any data in Copilot's context for a targeted user, including emails, documents, chats and prior Copilot conversations, could have been sent to an attacker without the user noticing.
- Remediation: fixed server-side by Microsoft; no customer patching was required.
- Industry impact: a critical CVE for a production AI assistant, widely cited as the first real-world zero-click prompt injection exploit.
What this means for NHI governance
EchoLeak did not steal a password, token or key. It hijacked something more subtle: the authority of an AI assistant acting on behalf of a user. Copilot could read the user's mail and files because it works with that user's access. The attacker never needed that access. They only needed to put text in front of the model and let the model use its own.
That is why AI assistants and agents belong in the non-human identity inventory. They hold delegated access, act without a human approving each step and are steered by content that may come from anyone. Prompt injection and identity and privilege abuse are usually discussed as separate agentic risks. EchoLeak shows the two together: untrusted input in, trusted data out, using a legitimate identity's permissions.
Existing guardrails were bypassed one by one: the injection classifier, link redaction and a Content Security Policy that trusted Microsoft's own domains. The durable controls are identity controls: limit what an AI assistant can reach, keep sensitive content out of its scope, separate untrusted inputs from privileged actions, and log what it retrieves and returns. Similar patterns appear on our timeline in the Gemini calendar prompt injection and CoPhish Copilot Studio token theft.
Recommendations
- Treat AI assistants and agents as identities. Record what each one can access, on whose behalf and who owns it. Our guide to the OWASP Top 10 for Agentic Applications maps these risks.
- Shrink the assistant's data scope. Apply sensitivity labels and access restrictions so the most sensitive content is not retrievable by general-purpose assistants, and review oversharing in SharePoint and OneDrive before wide roll-out.
- Separate untrusted input from privileged context. Where you build your own assistants or agents, tag external content such as inbound email as untrusted and do not let it trigger actions or reach sensitive data.
- Control outbound channels. Restrict what rendered AI output can fetch, including images and link previews, and monitor for data in URLs.
- Log and review AI activity. Keep audit logs of what assistants retrieve and return, and include them in identity threat detection.
- Apply least privilege to every non-human identity. See The Ultimate Guide to Non-Human Identities.
Frequently asked questions
What is EchoLeak?
EchoLeak is a zero-click vulnerability in Microsoft 365 Copilot, tracked as CVE-2025-32711 and found by Aim Security, that let an attacker exfiltrate data from Copilot's context by sending a crafted email.
Was anyone breached through EchoLeak?
Microsoft says no. It fixed the issue server-side before disclosure, found no evidence of exploitation in the wild and says no customers were affected.
Do Microsoft 365 customers need to do anything?
No patch was needed, according to Microsoft. The wider lesson still applies: limit what AI assistants can access and treat content they read from outside the organisation as untrusted.
Related NHI Mgmt Group resources
Gemini AI breach via calendar prompt injection · Copilot Studio agents exploited in CoPhish · Gemini CLI silent code execution · Human vs Non-Human Identity · NHI breaches timeline
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target AI assistants, service accounts, API keys, tokens and secrets. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.
References
- Fortune: Exclusive: New Microsoft Copilot flaw signals broader risk of AI agents being hacked (11 June 2025)
- The Hacker News: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction (12 June 2025)
- arXiv: EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System (September 2025)
- Cato Networks: Breaking down EchoLeak, the first zero-click AI vulnerability (2025)
- Varonis: EchoLeak in Microsoft Copilot: What it Means for AI Security (June 2025)
