Disclosed vulnerability
EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot via an emailed LLM scope violation
AIR-2025-0039 AIR record · 2025-06-microsoft-echoleak
From the supporting source
Aim Labs has identified a critical zero-click AI vulnerability, dubbed “EchoLeak”, in Microsoft 365 (M365) Copilot and has disclosed several chains involving this vulnerability to Microsoft’s MSRC team.catonetworks.com
The record
Disclosed
2025-06-11
Occurred
2025-01
Vendor
Microsoft
Product
Microsoft 365 Copilot
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot auto-ingested the email and auto-fetched the exfiltration image
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection email
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
All Microsoft 365 Copilot tenants; exposure covers chat history, OneDrive, SharePoint, Teams and preloaded org data
Capability abused
Defense & remediation
Recorded defense
XPIA classifier and link redaction
Guardrail kinds
Input classifier, Output filter
Guardrail outcome
Silent
Fix shipped
Server-side; Microsoft advisory states the issue was fully addressed with no customer action required
Taxonomy & references
Curator notes
The original Aim Security disclosure now resolves to Cato Networks after the acquisition; the Cato mirror is the originating Aim Labs writeup. Microsoft’s MSRC advisory independently records the CVE and states that the service-side issue was fully mitigated. | Merged from duplicate id `2025-06-aim-echoleak`. Also reported under the titles: 'EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot via a crafted email'; 'EchoLeak: zero-click prompt-injection data exfiltration from Microsoft 365 Copilot'.
Supporting sources
- https://www.catonetworks.com/blog/breaking-down-echoleak/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711
- https://www.cybersecuritydive.com/news/flaw-microsoft-copilot-zero-click-attack/750456/
- https://arxiv.org/abs/2509.10540
- https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml
Cite as
Enkrypt AI. "EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot via an emailed LLM scope violation". AIR, AIR-2025-0039. https://agentincident.vercel.app/i/AIR-2025-0039/ (accessed 2026-10-19).