STUPID-2026-0051
EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)
Why 9/10
One email with no clicks could exfiltrate anything Copilot could reach. Patched; no confirmed in-the-wild exploitation.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Status and what to do
- Affected
- Microsoft 365 Copilot before the June 2025 server-side patch.
- Fix status
- Fixed · Microsoft patched it server-side; no customer action was required, per the linked report.
- Mitigation
- None needed for current Microsoft 365 Copilot. The general lesson: content an assistant reads (email, documents) can carry instructions.
- Last reviewed
- 2026-10-29 · Report a correction to this record
Instruction given
Summarize recent emails and documents for the user with Microsoft 365 Copilot.
Expected behavior
Never treat content of an untrusted incoming email as instructions, and never exfiltrate corporate data.
Actual behavior
A single crafted email — with a hidden prompt embedded as an HTML comment or white-on-white text — was retrieved by Copilot's RAG engine when the user later asked an unrelated question. The hidden instructions executed, causing Copilot to leak internal documents, emails, and files via markdown links, with no user interaction ('zero-click').
Damage
Any data in Copilot's reach — Outlook, Teams, OneDrive, SharePoint, Office files — could be silently exfiltrated by sending one email. Aim Security disclosed it in June 2025; Microsoft shipped a server-side patch. No confirmed in-the-wild exploitation.
Full write-up
EchoLeak (CVE-2025-32711, CVSS 9.3) was the first documented zero-click prompt-injection exploit against a production LLM system — Microsoft 365 Copilot across Word, Excel, PowerPoint, Outlook, and Teams. An attacker sent a benign-looking email containing a hidden prompt (an HTML comment or white-on-white text). The payload was invisible to the user but parsed and retained by Copilot's engine. Later, when the user asked Copilot something ordinary like 'summarize recent strategy updates,' the retrieval-augmented-generation engine pulled the malicious email into context and executed its instructions — exfiltrating internal documents, emails, and files through markdown links and images, bypassing Microsoft's prompt-injection classifiers, link redaction, and CSP. Discovered by Aim Security and disclosed in June 2025, it required zero clicks from the victim and exposed how RAG-based AI assistants inherit the trust of everything they can read.
Classification
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Backend
- OWASP Agentic Top 10 (our mapping)
- ASI01 Agent Goal Hijack · ASI02 Tool Misuse and Exploitation list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks · 2.1 Compromise of privacy by leaking or correctly inferring sensitive information taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0051: EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0051/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0050By IDSTUPID-2026-0052 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.