EchoLeak: the zero-click prompt-injection flaw in Microsoft 365 Copilot

How the chain worked

In June 2025, Aim Labs disclosed EchoLeak, a zero-click prompt-injection vulnerability in Microsoft 365 Copilot. A crafted email could influence Copilot when it retrieved the message as part of an ordinary response. In the researchers’ demonstration, instructions hidden in the email steered Copilot toward data already in its Microsoft 365 context and into an outbound link. The chain bypassed multiple protections, including prompt-injection filtering and link handling. Microsoft assigned CVE-2025-32711.

The attack did not require the recipient to click a link or deliberately open the crafted email. A key design failure was allowing untrusted email text to influence a trusted action, so Copilot could combine outside instructions with privileged organizational context. Aim Labs privately reported the issue to Microsoft, which deployed a server-side fix before public disclosure. Aim Labs said it knew of no customer impact, and Microsoft confirmed no customers were affected. This was a demonstrated vulnerability, not a reported customer data breach.

What teams can change

Connected assistants should treat messages and documents as untrusted even when a user asks for a routine summary. A model should not be able to turn outside text into an outbound action or broaden what data it can access.

• Limit which mailboxes, files, and chats an assistant can retrieve
• Enforce outbound-action and link-fetching rules outside the model
• Review whether external content can reach tools or data sources with greater privileges