{ "schema_version": "0.4", "id": "REG-0021", "title": "EchoLeak: a crafted email makes Microsoft 365 Copilot exfiltrate data with no user action, disclosed 11 June 2025", "batch": "B2", "family": "software", "context": { "domain": "Software agent (enterprise assistant with retrieval)", "autonomy_level": "alone", "actor_type": "Software: Microsoft 365 Copilot", "actors": { "count": 1, "text": "1", "roles": [ "defender" ] }, "mandate_context": "demonstration", "jurisdiction": [ "Global (vendor, researcher)" ], "autonomy_level_text": "Machine acts within a user request, with no human reviewing the action (zero-click)", "mandate_context_text": "Demonstration" }, "provenance_tier": "disclosure_corroborated", "status": "confirmed", "fields": [ { "layer": "Mandate", "facet": "principal", "value": "The Copilot user, asking an ordinary question", "assertion_type": "assertion", "source_ids": [ "AIM-BLOG" ], "confidence": "high", "disputed": false }, { "layer": "Actor", "facet": null, "value": "Microsoft 365 Copilot", "assertion_type": "fact", "source_ids": [ "AIM", "MSRC" ], "confidence": "high", "disputed": false }, { "layer": "Inputs", "facet": null, "value": "An attacker's email, written to look like instructions to the reader, retrieved later into the assistant's context when the user asked an ordinary business question", "assertion_type": "assertion", "source_ids": [ "AIM-BLOG" ], "confidence": "high", "disputed": false }, { "layer": "Decision", "facet": null, "value": "The assistant followed the embedded instructions and composed output containing a reference to an attacker-controlled address with sensitive data appended", "assertion_type": "assertion", "source_ids": [ "AIM-BLOG" ], "confidence": "high", "disputed": false }, { "layer": "Envelope", "facet": "constraints", "value": "A prompt-injection classifier, redaction of external links and images, and content-security rules existed; the researchers bypassed them in turn by phrasing the email as instructions to the human reader, by reference-style markdown the redaction did not recognize, and by routing the fetch through a Microsoft Teams domain the content-security policy allowed", "assertion_type": "assertion", "source_ids": [ "AIM-BLOG" ], "confidence": "high", "disputed": false }, { "layer": "Action", "facet": null, "value": "Data left the tenant through a fetch the user never saw; zero clicks", "assertion_type": "assertion", "source_ids": [ "AIM-BLOG" ], "confidence": "high", "disputed": false }, { "layer": "Outcome", "facet": null, "value": "State: averted by disclosure. CVE-2025-32711, published 11 June 2025: information disclosure over a network with no user interaction. Microsoft rated it critical (9.3); the National Vulnerability Database scores it 7.5, high. No exploitation reported.", "assertion_type": "fact", "source_ids": [ "AIM", "MSRC" ], "confidence": "high", "disputed": false }, { "layer": "Evidence", "facet": "event", "value": "Researcher disclosure with the attack chain; the CVE record; Microsoft's advisory", "assertion_type": "fact", "source_ids": [ "AIM-BLOG", "AIM", "MSRC" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "technical", "value": "Fixed by Microsoft before disclosure; no customer action required", "assertion_type": "fact", "source_ids": [ "MSRC" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "accountability", "value": "Coordinated disclosure: Aim Labs disclosed the attack chains to Microsoft's Security Response Center, and Microsoft's advisory credits Aim Labs; neither gives a date. BleepingComputer reports that the researchers devised the attack in January 2025 and reported it to Microsoft", "assertion_type": "assertion", "source_ids": [ "AIM-BLOG", "MSRC", "BLEEPINGCOMPUTER" ], "confidence": "high", "disputed": false } ], "controls": { "failed": [ { "id": "C-E5", "note": "Output protections bypassed in turn: redaction of external links and images, by reference-style markdown the redaction did not recognize, and the content-security rules, by routing the fetch through a Microsoft Teams domain they allowed (trusted-domain exception)", "confidence": "medium", "basis": "curated" }, { "id": "C-I1", "note": "Injection classifier; Treating retrieved content as data rather than instruction (absent)", "confidence": "high", "basis": "curated" } ], "succeeded": [ { "id": "C-O1", "note": "Coordinated disclosure", "confidence": "high", "basis": "curated" } ], "absent": [] }, "applicable_rules": [ "None agent-specific; vendor security development lifecycle" ], "unmapped": [], "corrections": [ { "date": "2026-10-13", "field": "controls.C-I1", "old": "failed: Injection classifier; absent: Treating retrieved content as data rather than instruction", "new": "failed: Injection classifier; Treating retrieved content as data rather than instruction (absent)", "reason": "a control has one state per case; entries in two states merged into the state the record supports" }, { "date": "2026-10-13", "field": "context.jurisdiction", "old": "Global (vendor | researcher)", "new": "Global (vendor, researcher)", "reason": "jurisdiction text was split at a comma inside parentheses" }, { "date": "2026-10-13", "field": "fields and sources", "old": "all claims cited to one bundled source typed as regulator; 'rated critical'; 'patched server-side in May 2025'", "new": "CVE record, Microsoft's advisory, and the researchers' write-up cited separately; both ratings given; fix wording as the advisory states it", "reason": "claims aligned to what each linked record says, found on review" }, { "date": "2026-10-13", "field": "fields", "old": "'an unrelated question'; actor described as the 'retrieval and generation pipeline' on the CVE record", "new": "'an ordinary business question'; actor as the CVE record and advisory name it", "reason": "independent check against the linked records before right-of-reply letters" }, { "date": "2026-10-14", "field": "reviewed_by", "old": "none", "new": "Saurabh Bhatnagar (editor)", "reason": "case checked by the editor against its linked records" }, { "date": "2026-10-14", "field": "named_parties[Aim Security].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null}", "reason": "right of reply offered by email from register@secureautonomous.com to press@catonetworks.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction" }, { "date": "2026-10-14", "field": "named_parties[Microsoft].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null}", "reason": "right of reply offered by email from register@secureautonomous.com to rapidresponse@wecommunications.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction" }, { "date": "2026-10-16", "field": "inference.value", "old": "The attacker never touched the actor; it only placed text where the actor would later read it. That is the software form of sensor spoofing, and it is why Inputs is a layer rather than a note", "new": "The attacker never touched the system; it only placed text where the system would later read it. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right.", "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged" }, { "date": "2026-10-16", "field": "context.autonomy_level", "old": "supervised", "new": "alone", "reason": "Found in an outside review of the published record on 16 October 2026: the exfiltration needed no user action, so 'human supervises' misdescribed it" }, { "date": "2026-10-18", "field": "named_parties[Microsoft].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": \"We addressed the issue and no customer action is required. The purpose of CVE-2025-32711 being released is for greater transparency as we outline in our blog: Toward greater transparency: Unveiling Cloud Service CVEs.\", \"received\": \"2026-10-16\"}", "reason": "Statement received on 16 October 2026 from Microsoft's media relations agency, \"on behalf of Microsoft\", in reply to the 14 October letter; published verbatim (the original links CVE-2025-32711 to https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711/ and the blog title to https://aka.ms/MSRC-Cloud-CVEs); recorded at the editor's instruction" }, { "date": "2026-10-18", "field": "outcome.regime_consequence", "old": "CVE-2025-32711", "new": "none", "reason": "A CVE record is a public disclosure, not a regulatory or legal consequence. Microsoft's statement of 16 October 2026 says CVE-2025-32711 was published for transparency under its policy of issuing CVEs for cloud services. The CVE stays in the case's outcome and evidence. Classification call by the editor." }, { "date": "2026-10-19", "field": "named_parties[Aim Security].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": \"We have no edits to add, but if you can link to the below source that would be much appreciated. https://www.catonetworks.com/blog/breaking-down-echoleak/\", \"received\": \"2026-10-19\"}", "reason": "Reply received on 19 October 2026 from Cato Networks' director of communications, for Aim Security (which Cato Networks acquired), in reply to the 14 October letter: no corrections; published verbatim; recorded at the editor's instruction" }, { "date": "2026-10-19", "field": "sources.CATO-BLOG", "old": null, "new": "https://www.catonetworks.com/blog/breaking-down-echoleak/", "reason": "Added at the request of Cato Networks in its reply of 19 October 2026: the Aim Labs EchoLeak write-up already cited as AIM-BLOG, by the same author (Itay Ravia), now also hosted on Cato's blog; no claim in the case changes; added at the editor's instruction" }, { "date": "2026-10-20", "field": "fields.Envelope constraints", "old": "A prompt-injection classifier and content-security rules existed; the researchers bypassed both using formats and domains the rules trusted", "new": "A prompt-injection classifier, redaction of external links and images, and content-security rules existed; the researchers bypassed them in turn by phrasing the email as instructions to the human reader, by reference-style markdown the redaction did not recognize, and by routing the fetch through a Microsoft Teams domain the content-security policy allowed", "reason": "Found in the editor's source re-check of 19-20 October 2026: the Aim Labs write-up (read in its Cato Networks copy, CATO-BLOG) says the cross-prompt injection classifier 'was easily bypassed simply by phrasing the email' as instructions for the recipient, that 'Reference-style markdown links are not redacted' (the chain is 'Prompt injection -> Image redaction bypass -> CSP bypass', CSP being the content-security policy), and that the image content-security policy allowed *.teams.microsoft.com; the old wording credited formats with defeating the classifier and left out the redaction control" }, { "date": "2026-10-20", "field": "fields.Recovery accountability", "old": "Coordinated disclosure: reported to Microsoft in January 2025", "new": "Coordinated disclosure: Aim Labs disclosed the attack chains to Microsoft's Security Response Center, and Microsoft's advisory credits Aim Labs; neither gives a date. BleepingComputer reports that the researchers devised the attack in January 2025 and reported it to Microsoft", "reason": "Found in the editor's source re-check of 19-20 October 2026: the copy of the Aim Labs write-up the Register links (CATO-BLOG; the AIM-BLOG address refuses automated reading) says Aim Labs 'has disclosed several chains involving this vulnerability to Microsoft's MSRC team' (its Security Response Center) but gives no date; Microsoft's advisory (June 2025 security update data) acknowledges 'Aim Labs (Part of Aim Security)', also without a date; the January 2025 date comes from BleepingComputer, 11 June 2025, so it is now attributed there" }, { "date": "2026-10-20", "field": "fields.Recovery accountability.source_ids", "old": "[\"AIM-BLOG\"]", "new": "[\"AIM-BLOG\", \"MSRC\", \"BLEEPINGCOMPUTER\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: Microsoft's advisory acknowledgement (MSRC) and the BleepingComputer report carrying the January 2025 date (BLEEPINGCOMPUTER) now cited" }, { "date": "2026-10-20", "field": "sources.BLEEPINGCOMPUTER", "old": null, "new": "{\"title\": \"Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (BleepingComputer, Bill Toulas)\", \"type\": \"press_pointer\", \"url\": \"https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/\", \"via_press\": true, \"date\": \"2025-06-11\", \"tier\": \"press\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: BleepingComputer, Bill Toulas, 11 June 2025: 'The attack was devised by Aim Labs researchers in January 2025, who reported their findings to Microsoft'; added as the source of the January 2025 date, which no primary record read gives" }, { "date": "2026-10-20", "field": "inference.value", "old": "The attacker never touched the system; it only placed text where the system would later read it. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right.", "new": "The attacker needed no access to the victim's organization or to Copilot: it only sent an email, which the assistant later retrieved and followed as instructions. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right. The record shows a researchers' demonstration, fixed before disclosure; it does not show the technique used against any customer.", "reason": "Found in the editor's source re-check of 19-20 October 2026: 'never touched the system' overstated it: the attacker's email entered the victim's Microsoft 365 mailbox and, in the zero-click route, the data went out through a Microsoft Teams address. What the sources show is that the attacker needed no access: the National Vulnerability Database entry (AIM) describes 'an unauthorized attacker' with no privileges required, and the Aim Labs write-up says an adversary 'simply needs to send an email to the victim' although Copilot's interface is 'open only to organization employees'. Added what the record does not show: Microsoft's advisory says exploited 'No'. 'Sensor spoofing' stays as the Register's own analogy. The interpretation was unsigned, so no signature is cleared" }, { "date": "2026-10-20", "field": "inference.source_ids", "old": "[\"AIM\"]", "new": "[\"AIM-BLOG\", \"AIM\", \"MSRC\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: the interpretation was cited only to the National Vulnerability Database entry (AIM), which does not describe the email or its retrieval; the Aim Labs write-up (AIM-BLOG) and Microsoft's advisory (MSRC) now cited for those parts" }, { "date": "2026-10-20", "field": "sources.AIM-BLOG.title", "old": "Aim Labs, 'Breaking down EchoLeak', 11 June 2025 (researcher disclosure)", "new": "Aim Labs, 'Breaking down \"EchoLeak\", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure)", "reason": "Found in the editor's source re-check of 19-20 October 2026: the full headline, as the Cato Networks copy (CATO-BLOG) and Simon Willison's link post of 11 June 2025 give it" }, { "date": "2026-10-20", "field": "sources.AIM, MSRC, CATO-BLOG.checked", "old": "2026-10-13 (AIM, MSRC); 2026-10-19 (CATO-BLOG)", "new": "2026-10-20", "reason": "Found in the editor's source re-check of 19-20 October 2026: re-read on 20 October 2026: the National Vulnerability Database record through its public API, Microsoft's advisory through the Security Update Guide API and the June 2025 security update data, and the Cato Networks page. AIM-BLOG's own address refused automated reading (403), so its checked date is left unchanged and its text was read in the CATO-BLOG copy" }, { "date": "2026-10-21", "field": "controls.C-E5", "old": "Content-security rules (trusted-domain exception)", "new": "Output protections bypassed in turn: redaction of external links and images, by reference-style markdown the redaction did not recognize, and the content-security rules, by routing the fetch through a Microsoft Teams domain they allowed (trusted-domain exception)", "reason": "Editor's classification call of 21 October 2026 (call 11, accepted from pull request #74): link and image redaction is a limit on data leaving, like the content-security rules, so it is folded into this control's note rather than mapped separately; wording from field F5 (Aim Labs write-up). Confidence stays medium." } ], "created": "2026-10-06", "last_reviewed": "2026-10-20", "actor_status": "confirmed", "provenance_tier_text": "Researcher disclosure; CVE; vendor patch", "status_text": "Confirmed (demonstrated; no exploitation known)", "outcome": { "state": "averted_by_disclosure", "severity": "none (demonstration)", "affected_parties": [], "cost": "none", "regime_consequence": "none", "as_of": "Jun 2025", "derived_by": "backfill-curated" }, "inference": { "value": "The attacker needed no access to the victim's organization or to Copilot: it only sent an email, which the assistant later retrieved and followed as instructions. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right. The record shows a researchers' demonstration, fixed before disclosure; it does not show the technique used against any customer.", "source_ids": [ "AIM-BLOG", "AIM", "MSRC" ], "confidence": "high", "signed_by": "Saurabh Bhatnagar", "signed_on": "2026-10-21" }, "named_parties": [ { "name": "Microsoft", "right_of_reply": { "offered": "2026-10-14", "response": "We addressed the issue and no customer action is required. The purpose of CVE-2025-32711 being released is for greater transparency as we outline in our blog: Toward greater transparency: Unveiling Cloud Service CVEs.", "received": "2026-10-16", "assessed_through": "2026-10-22", "assessments": [ { "through": "2026-10-22", "date": "2026-10-22", "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering", "triggered": [], "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own" } ] } }, { "name": "Aim Security", "right_of_reply": { "offered": "2026-10-14", "response": "We have no edits to add, but if you can link to the below source that would be much appreciated. https://www.catonetworks.com/blog/breaking-down-echoleak/", "received": "2026-10-19", "assessed_through": "2026-10-22", "assessments": [ { "through": "2026-10-22", "date": "2026-10-22", "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering", "triggered": [], "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own" } ] } } ], "sources": { "AIM": { "title": "NVD entry CVE-2025-32711: AI command injection in M365 Copilot (information disclosure)", "type": "public_record", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711", "via_press": false, "date": "2025-06-11", "tier": "public_regulatory", "interest": null, "primary": true, "checked": "2026-10-20" }, "AIM-BLOG": { "title": "Aim Labs, 'Breaking down \"EchoLeak\", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure)", "type": "researcher", "url": "https://www.aim.security/lp/aim-labs-echoleak-blogpost", "via_press": false, "date": "2025-06-11", "tier": "researcher", "interest": null, "primary": true, "checked": "2026-10-13" }, "MSRC": { "title": "Microsoft Security Response Center, CVE-2025-32711 advisory", "type": "company", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711", "via_press": false, "date": "2025-06-11", "tier": "company", "interest": null, "primary": true, "checked": "2026-10-20" }, "CATO-BLOG": { "title": "'Breaking down EchoLeak': the Aim Labs write-up (AIM-BLOG), also on the blog of Cato Networks, which acquired Aim Security", "type": "researcher", "url": "https://www.catonetworks.com/blog/breaking-down-echoleak/", "via_press": false, "date": null, "tier": "researcher", "interest": null, "primary": true, "checked": "2026-10-20" }, "BLEEPINGCOMPUTER": { "title": "Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (BleepingComputer, Bill Toulas)", "type": "press_pointer", "url": "https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/", "via_press": true, "date": "2025-06-11", "tier": "press", "interest": null, "primary": false, "checked": "2026-10-20" } }, "derived_by": "backfill-curated", "reviewed_by": "Saurabh Bhatnagar (editor)" }