EchoLeak: Zero-Click Data Theft from Microsoft 365 Copilot
On this page
The first widely-reported zero-click attack on an enterprise AI assistant — no link, no click, just an email sitting in your inbox.
| When | June 2025 |
|---|---|
| Target | Microsoft 365 Copilot |
| Vendor | Microsoft |
| Researcher | Aim Labs (Aim Security) |
| Technique | Zero-click indirect prompt injection via email → RAG |
| CVE | CVE-2025-32711 — CVSS 9.3 (Critical) |
- 1Attacker emails the victim a message containing hidden instructions
- 2Later, the user asks Copilot an unrelated question; retrieval pulls the email into context
- 3Copilot follows the hidden instructions and leaks in-scope data over an allowlisted URL
What happened
In June 2025, researchers at Aim Labs disclosed EchoLeak — a zero-click vulnerability in Microsoft 365 Copilot. A single crafted email, containing instructions hidden in its content, needed no click and no interaction. It simply waited until the user later asked Copilot an ordinary question; Copilot's retrieval then pulled the email into its working context and acted on the hidden instructions, quietly gathering the user's sensitive data and leaking it outward. Microsoft assigned it CVE-2025-32711 with a critical CVSS score of 9.3.
How the attack worked
Copilot answers by retrieving relevant material — emails, chats, files — into the model's context. The attacker's email became one of those retrieved chunks. Its hidden instructions coerced Copilot into pulling in-scope data (chat logs, OneDrive and SharePoint files, Teams messages) and exfiltrating it through URLs the environment already trusted. No user action was required at any step.
LLM Scope ViolationAim Labs named the underlying class: untrusted external input causing the model to act on privileged internal data it was otherwise allowed to see — a trust boundary the application never enforced.
Root cause
Retrieval mixed untrusted content (an inbound email) with trusted data (your files) in a single context, with no boundary between them — and the model's output could reach attacker-usable URLs. That is the same RAG pattern nearly every enterprise assistant is built on.
What a test would have caught
An indirect-injection test that plants instructions in ingestible content (an email, a document) and checks whether the assistant will act on privileged data or emit an outbound URL would have surfaced both halves of EchoLeak before shipping.
How to prevent it
- Isolate untrusted retrieved content from privileged data — never let one email's instructions govern what the model does with your files.
- Constrain egress: allowlist and validate every URL the client will auto-fetch or render, so there is no exfiltration channel.
- Enforce scope server-side: the model acting on privileged data must be gated by the user's intent, not by whatever the retrieved text says.
Feel it yourselfThe replay lab recreates the exfiltration channel EchoLeak abused — get an assistant to leak its context through a rendered image URL.
FAQ
What made EchoLeak “zero-click”?
The victim never had to click or open anything. The malicious email sat in the mailbox until the user asked Copilot an unrelated question; Copilot's retrieval then pulled the hidden instructions into its context and acted on them automatically.
What is an “LLM Scope Violation”?
The name the researchers gave the underlying flaw: untrusted external input (an email) causes the model to act on privileged internal data (your files and chats) it is otherwise allowed to see — crossing a trust boundary the app never enforced.
How was it fixed?
Microsoft applied a server-side fix before public disclosure, so customers needed to do nothing. But the root cause — retrieval mixing untrusted content with trusted data in one context — is a design pattern every RAG assistant shares.
Sources
- Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction — The Hacker News
- CVE-2025-32711 (GHSA-h2w9-p5qf-qmrh) — GitHub Advisory Database
- Researchers Detail Zero-Click Copilot Exploit ‘EchoLeak’ — Dark Reading