Microsoft 365 Copilot Exposed to Critical Zero-Click Vulnerability ‘EchoLeak’

Introduction

Researchers from Aim Labs have uncovered a critical zero-click vulnerability in Microsoft 365 Copilot [6] [10], known as CVE-2025-32711 or ‘EchoLeak.’ This vulnerability, with a CVSS score of 9.3 [4] [5], allows attackers to exfiltrate sensitive corporate data through a single malicious email without user interaction [8]. EchoLeak is the first documented zero-click attack on an AI agent, highlighting significant security challenges as AI tools become more prevalent in organizations.

Description

Researchers from Aim Labs have identified a significant zero-click vulnerability in Microsoft 365 Copilot [2] [6] [10], designated as CVE-2025-32711 and known as ‘EchoLeak.’ With a CVSS score of 9.3, this vulnerability allows attackers to automatically exfiltrate sensitive and proprietary corporate data through a single malicious email, requiring no user interaction [4] [7] [8] [9], such as downloading a file or clicking a link [9]. EchoLeak represents the first documented zero-click attack on an AI agent [8], highlighting substantial security challenges as organizations increasingly adopt AI tools. The attack exploits design flaws in Microsoft 365 Copilot’s Retrieval-Augmented Generation (RAG) system [4], which processes various organizational data [4], including chat histories, emails [1] [2] [3] [4] [5] [6] [8] [9], OneDrive documents [4] [10], SharePoint content [1] [4] [5] [10], and Teams conversations [1] [4] [10].

EchoLeak enables attackers to send crafted emails containing specific markdown syntax that instructs the AI to silently scan the email, leading to unauthorized data requests and allowing confidential information to be sent to an attacker’s server [8]. This method, referred to as “RAG spraying,” involves sending emails with multiple topic-specific sections to enhance the likelihood of retrieving sensitive data from Copilot’s vector database [4]. Attackers can bypass Microsoft’s Cross-Prompt Injection Attacks (XPIA) classifiers by disguising malicious instructions as human-directed content and utilizing reference-style markdown formats, including image markdown, to evade detection and facilitate automated data exfiltration.

The discovery introduces a new attack class termed ‘Large Language Model (LLM) Scope Violation,’ which describes how untrusted content can manipulate AI systems into accessing privileged data without user consent, violating the Principle of Least Privilege [1]. This vulnerability poses risks to organizations using Microsoft 365 Copilot’s default configuration [4], as it circumvents key security measures and exploits obscure markdown formatting to create an invisible channel for sensitive data to exit the organization. The flaw acted like an open mic, unintentionally disclosing user data and undermining trust in technology [7], with potential implications for privacy, including risks of phishing and identity theft.

This incident underscores the necessity for enterprises to adopt a proactive approach to adversarial prompt injection, necessitating real-time behavioral monitoring and agent-specific threat modeling [8]. Analysts emphasize the importance of robust input validation and data isolation [8], particularly in sectors like banking [8], healthcare [8], and defense [8], where AI tools can inadvertently serve as data exfiltration mechanisms [8]. The incident illustrates that traditional security measures may fail against such attacks [8], as AI systems can be manipulated through seemingly innocuous inputs [8].

Aim Labs reported the flaw to Microsoft in January 2025 [6], and while the MSRC team has been informed, details on patches or mitigations remained undisclosed until a server-side fix was finalized by Microsoft in May 2025. The company has confirmed that no customers were affected by actual attacks [8], and it has implemented additional defense mechanisms to enhance the security of Microsoft 365 Copilot following the discovery [10]. To mitigate risks [5], users are advised to disable external email ingestion in Copilot [5], review incoming emails for prompts [5], implement AI-specific runtime guardrails [5], and restrict markdown rendering in AI outputs [5]. As the attack surface for AI expands [8], the potential for exploitation of AI’s own logic becomes increasingly evident [8], calling for a new protection paradigm for AI agents [8], with runtime security as a minimum standard [8].

Conclusion

The EchoLeak vulnerability in Microsoft 365 Copilot underscores the urgent need for enhanced security measures as AI tools become integral to organizational operations. The incident highlights the potential for AI systems to be exploited through zero-click attacks, necessitating a shift in security paradigms. Organizations must adopt proactive strategies, including real-time monitoring and robust input validation, to mitigate such risks. As AI continues to evolve, establishing comprehensive security frameworks will be crucial to safeguarding sensitive data and maintaining trust in AI technologies.

References

You may also want to see:

Southampton UK