EchoLeak: a crafted email makes Microsoft 365 Copilot exfiltrate data with no user action, disclosed 11 June 2025
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | The Copilot user, asking an ordinary question | assertion | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure) | high |
| Actor | Microsoft 365 Copilot | fact | NVD entry CVE-2025-32711: AI command injection in M365 Copilot (information disclosure); Microsoft Security Response Center, CVE-2025-32711 advisory | high |
| Inputs | An attacker's email, written to look like instructions to the reader, retrieved later into the assistant's context when the user asked an ordinary business question | assertion | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure) | high |
| Decision | The assistant followed the embedded instructions and composed output containing a reference to an attacker-controlled address with sensitive data appended | assertion | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure) | high |
| Envelope: constraints | A prompt-injection classifier, redaction of external links and images, and content-security rules existed; the researchers bypassed them in turn by phrasing the email as instructions to the human reader, by reference-style markdown the redaction did not recognize, and by routing the fetch through a Microsoft Teams domain the content-security policy allowed | assertion | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure) | high |
| Action | Data left the tenant through a fetch the user never saw; zero clicks | assertion | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure) | high |
| Outcome | State: averted by disclosure. CVE-2025-32711, published 11 June 2025: information disclosure over a network with no user interaction. Microsoft rated it critical (9.3); the National Vulnerability Database scores it 7.5, high. No exploitation reported. | fact | NVD entry CVE-2025-32711: AI command injection in M365 Copilot (information disclosure); Microsoft Security Response Center, CVE-2025-32711 advisory | high |
| Evidence: event | Researcher disclosure with the attack chain; the CVE record; Microsoft's advisory | fact | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure); NVD entry CVE-2025-32711: AI command injection in M365 Copilot (information disclosure); Microsoft Security Response Center, CVE-2025-32711 advisory | high |
| Recovery: technical | Fixed by Microsoft before disclosure; no customer action required | fact | Microsoft Security Response Center, CVE-2025-32711 advisory | high |
| Recovery: accountability | Coordinated disclosure: Aim Labs disclosed the attack chains to Microsoft's Security Response Center, and Microsoft's advisory credits Aim Labs; neither gives a date. BleepingComputer reports that the researchers devised the attack in January 2025 and reported it to Microsoft | assertion | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure); Microsoft Security Response Center, CVE-2025-32711 advisory; Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (BleepingComputer, Bill Toulas) | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Output protections bypassed in turn: redaction of external links and images, by reference-style markdown the redaction did not recognize, and the content-security rules, by routing the fetch through a Microsoft Teams domain they allowed (trusted-domain exception) | C-E5 Containment and isolation |
| failed | Injection classifier; Treating retrieved content as data rather than instruction (absent) | C-I1 Retrieved content as data |
| succeeded | Coordinated disclosure | C-O1 Coordinated disclosure program |
Inference
inference The attacker needed no access to the victim's organization or to Copilot: it only sent an email, which the assistant later retrieved and followed as instructions. That is the software form of sensor spoofing, and it is why what a system reads is treated as a risk in its own right. The record shows a researchers' demonstration, fixed before disclosure; it does not show the technique used against any customer.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| AIM | NVD entry CVE-2025-32711: AI command injection in M365 Copilot (information disclosure) | public record primary record | nvd.nist.gov ↗ checked 2026-10-20 |
| AIM-BLOG | Aim Labs, 'Breaking down "EchoLeak", the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot', 11 June 2025 (researcher disclosure) | researcher primary record | aim.security ↗ checked 2026-10-13 |
| MSRC | Microsoft Security Response Center, CVE-2025-32711 advisory | company primary record | msrc.microsoft.com ↗ checked 2026-10-20 |
| CATO-BLOG | 'Breaking down EchoLeak': the Aim Labs write-up (AIM-BLOG), also on the blog of Cato Networks, which acquired Aim Security | researcher primary record | catonetworks.com ↗ checked 2026-10-20 |
| BLEEPINGCOMPUTER | Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (BleepingComputer, Bill Toulas) | press pointer secondary: press report | bleepingcomputer.com ↗ checked 2026-10-20 |