EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
June 11, 2025
Expected Behavior
Never treat content of an untrusted incoming email as instructions, and never exfiltrate corporate data.
What Actually Happened
A single crafted email — with a hidden prompt embedded as an HTML comment or white-on-white text — was retrieved by Copilot's RAG engine when the user later asked an unrelated question. The hidden instructions executed, causing Copilot to leak internal documents, emails, and files via markdown links, with no user interaction ('zero-click').
Damage Assessment
Any data in Copilot's reach — Outlook, Teams, OneDrive, SharePoint, Office files — could be silently exfiltrated by sending one email. Aim Security disclosed it in June 2025; Microsoft shipped a server-side patch. No confirmed in-the-wild exploitation.
Full Report
EchoLeak (CVE-2025-32711, CVSS 9.3) was the first documented zero-click prompt-injection exploit against a production LLM system — Microsoft 365 Copilot across Word, Excel, PowerPoint, Outlook, and Teams. An attacker sent a benign-looking email containing a hidden prompt (an HTML comment or white-on-white text). The payload was invisible to the user but parsed and retained by Copilot's engine. Later, when the user asked Copilot something ordinary like 'summarize recent strategy updates,' the retrieval-augmented-generation engine pulled the malicious email into context and executed its instructions — exfiltrating internal documents, emails, and files through markdown links and images, bypassing Microsoft's prompt-injection classifiers, link redaction, and CSP. Discovered by Aim Security and disclosed in June 2025, it required zero clicks from the victim and exposed how RAG-based AI assistants inherit the trust of everything they can read.
Incident Metadata
- Agent
- Microsoft Copilot
- Failure Mode
- Security Vulnerability
- Root Cause
- Tool Misuse
- Task Type
- other
- Domain
- backend
- Source
- news_report