EchoLeak: a crafted email makes Microsoft 365 Copilot exfiltrate data with no user action, disclosed 11 June 2025

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Controls: c-e5. Editor's classification call of 21 october 2026 (call 11, accepted from pull request #74): link and image redaction is a limit on data leaving, like the content-security rules, so it is folded into this control's note rather than mapped separately; wording from field f5 (aim labs write-up). confidence stays medium.
  Show the change

  Before: Content-security rules (trusted-domain exception)

  After: Output protections bypassed in turn: redaction of external links and images, by reference-style markdown the redaction did not recognize, and the content-security rules, by routing the fetch through a Microsoft Teams domain they allowed (trusted-domain exception)
• 2026-10-20: Sources: aim, msrc, cato-blog: checked. Found in the editor's source re-check of 19-20 october 2026: re-read on 20 october 2026: the national vulnerability database record through its public api, microsoft's advisory through the security update guide api and the june 2025 security update data, and the cato networks page. aim-blog's own address refused automated reading (403), so its checked date is left unchanged and its text was read in the cato-blog copy.
  Show the change

  Before: 2026-10-13 (AIM, MSRC); 2026-10-19 (CATO-BLOG)

  After: 2026-10-20
• 2026-10-20: Sources: aim-blog: title. Found in the editor's source re-check of 19-20 october 2026: the full headline, as the cato networks copy (cato-blog) and simon willison's link post of 11 june 2025 give it.
  Show the change

  Before: Aim Labs, 'Breaking down EchoLeak', 11 June 2025 (researcher disclosure)

  After: Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure)
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the interpretation was cited only to the national vulnerability database entry (aim), which does not describe the email or its retrieval; the aim labs write-up (aim-blog) and microsoft's advisory (msrc) now cited for those parts.
  Show the change

  Before: ["AIM"]

  After: ["AIM-BLOG", "AIM", "MSRC"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: 'never touched the system' overstated it: the attacker's email entered the victim's microsoft 365 mailbox and, in the zero-click route, the data went out through a microsoft teams address. what the sources show is that the attacker needed no access: the national vulnerability database entry (aim) describes 'an unauthorized attacker' with no privileges required, and the aim labs write-up says an adversary 'simply needs to send an email to the victim' although copilot's interface is 'open only to organization employees'. added what the record does not show: microsoft's advisory says exploited 'no'. 'sensor spoofing' stays as the register's own analogy. the interpretation was unsigned, so no signature is cleared.
  Show the change

  Before: The attacker never touched the system; it only placed text where the system would later read it. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right

  After: The attacker needed no access to the victim's organization or to Copilot: it only sent an email, which the assistant later retrieved and followed as instructions. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right. The record shows a researchers' demonstration, fixed before disclosure; it does not show the technique used against any customer
• 2026-10-20: Fields: recovery accountability: source ids. Found in the editor's source re-check of 19-20 october 2026: microsoft's advisory acknowledgement (msrc) and the bleepingcomputer report carrying the january 2025 date (bleepingcomputer) now cited.
  Show the change

  Before: ["AIM-BLOG"]

  After: ["AIM-BLOG", "MSRC", "BLEEPINGCOMPUTER"]
• 2026-10-20: Fields: recovery accountability. Found in the editor's source re-check of 19-20 october 2026: the copy of the aim labs write-up the register links (cato-blog; the aim-blog address refuses automated reading) says aim labs 'has disclosed several chains involving this vulnerability to microsoft's msrc team' (its security response center) but gives no date; microsoft's advisory (june 2025 security update data) acknowledges 'aim labs (part of aim security)', also without a date; the january 2025 date comes from bleepingcomputer, 11 june 2025, so it is now attributed there.
  Show the change

  Before: Coordinated disclosure: reported to Microsoft in January 2025

  After: Coordinated disclosure: Aim Labs disclosed the attack chains to Microsoft's Security Response Center, and Microsoft's advisory credits Aim Labs; neither gives a date. BleepingComputer reports that the researchers devised the attack in January 2025 and reported it to Microsoft
• 2026-10-20: Fields: envelope constraints. Found in the editor's source re-check of 19-20 october 2026: the aim labs write-up (read in its cato networks copy, cato-blog) says the cross-prompt injection classifier 'was easily bypassed simply by phrasing the email' as instructions for the recipient, that 'reference-style markdown links are not redacted' (the chain is 'prompt injection -> image redaction bypass -> csp bypass', csp being the content-security policy), and that the image content-security policy allowed *.teams.microsoft.com; the old wording credited formats with defeating the classifier and left out the redaction control.
  Show the change

  Before: A prompt-injection classifier and content-security rules existed; the researchers bypassed both using formats and domains the rules trusted

  After: A prompt-injection classifier, redaction of external links and images, and content-security rules existed; the researchers bypassed them in turn by phrasing the email as instructions to the human reader, by reference-style markdown the redaction did not recognize, and by routing the fetch through a Microsoft Teams domain the content-security policy allowed
• 2026-10-18: Outcome: regime consequence. A cve record is a public disclosure, not a regulatory or legal consequence. microsoft's statement of 16 october 2026 says cve-2025-32711 was published for transparency under its policy of issuing cves for cloud services. the cve stays in the case's outcome and evidence. classification call by the editor.
  Show the change

  Before: CVE-2025-32711

  After: none
• 2026-10-16: Context: autonomy level. Found in an outside review of the published record on 16 october 2026: the exfiltration needed no user action, so 'human supervises' misdescribed it.
  Show the change

  Before: supervised

  After: alone
• 2026-10-13: Fields. Independent check against the linked records before right-of-reply letters.
  Show the change

  Before: 'an unrelated question'; actor described as the 'retrieval and generation pipeline' on the CVE record

  After: 'an ordinary business question'; actor as the CVE record and advisory name it
• 2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
  Show the change

  Before: all claims cited to one bundled source typed as regulator; 'rated critical'; 'patched server-side in May 2025'

  After: CVE record, Microsoft's advisory, and the researchers' write-up cited separately; both ratings given; fix wording as the advisory states it
• 2026-10-13: Context: jurisdiction. Jurisdiction text was split at a comma inside parentheses.
  Show the change

  Before: Global (vendor | researcher)

  After: Global (vendor, researcher)
• 2026-10-13: Controls: c-i1. A control has one state per case; entries in two states merged into the state the record supports.
  Show the change

  Before: failed: Injection classifier; absent: Treating retrieved content as data rather than instruction

  After: failed: Injection classifier; Treating retrieved content as data rather than instruction (absent)