EchoLeak: zero-click prompt injection flaw in Microsoft 365 Copilot (CVE-2025-32711)

EchoLeak is a vulnerability in Microsoft 365 Copilot, tracked as CVE-2025-32711, that let an attacker pull sensitive data out of a user's Copilot context by sending a single email, with no click required from the victim. It was disclosed publicly on 11 June 2025, after Microsoft had already fixed it on the server side in May.

What happened

Researchers at Aim Labs built the attack in January 2025 and reported it to Microsoft. It starts with an ordinary-looking email that reads like a business document but carries a hidden prompt injection telling the model to extract internal data. Because the instructions are worded as if addressed to a person, they slipped past Microsoft's cross-prompt injection classifier.

Later, when the user asks Copilot a related question, the retrieval engine pulls the email into the prompt. The model then places internal data inside a link or image reference; certain markdown image formats make the browser fetch the URL automatically, carrying the data out. Microsoft's content security policy blocked most outside domains, but trusted Teams and SharePoint URLs could be used to complete the transfer.

Impact

Dark Reading reported a critical CVSS score of 9.3 for the flaw, and said no cases of customers being compromised through it were known. How many tenants were exposed before the May fix is not publicly known.

Response

Microsoft shipped a fix and said customers did not need to take action. In a statement to Dark Reading it also said it was adding further defense-in-depth measures.

Lessons for security leaders

• Any assistant that reads inbound email is reading attacker-controlled input. Treat retrieval sources as an attack surface, not as trusted context.
• Ask vendors how their assistants handle links and images in generated answers, since automatic rendering is what turned this into a zero-click leak.
• Where the product allows it, limit which mailboxes, sites and file stores a copilot may retrieve from, starting with the most sensitive ones.
• Server-side fixes need no patching by customers, but they still belong in the risk register so owners know the exposure existed.