EchoLeak: an email alone could make Microsoft 365 Copilot leak data
Aim Security found that a crafted email could cause Microsoft 365 Copilot to send data from a user’s context to an attacker with no click. Microsoft fixed it as CVE-2025-32711.
- Disclosed
- Published
- Organization
- Microsoft
- System
- Microsoft 365 Copilot
- Impact
- Possible exfiltration of data from Copilot’s context without any user action; no exploitation in the wild reported
Timeline
- 2025-06-11. Microsoft releases its advisory for CVE-2025-32711.
- 2025-06-12. The Hacker News reports on Aim Security’s research.
Trigger or entry point
An email sent to an employee from outside the organization.
Failure mechanism
According to the report, the email contains instructions written for the model. When the user later asks Copilot a business question, the retrieval engine pulls the email into the same context as internal data. The model follows the instructions and returns private information through a URL that reaches the attacker. Aim Security calls this an “LLM Scope Violation”: untrusted input makes the model act on privileged data. The report lists four steps: the email arrives, the user asks Copilot a question, Copilot mixes the untrusted email with internal data, and the data leaves through Microsoft Teams and SharePoint URLs. According to Aim Security, the attack works in both single-turn and multi-turn conversations and does not depend on any specific behavior by the victim.
Impact
The vulnerability has a CVSS score of 9.3. The report states that there is no evidence it was exploited in the wild. The severity is potential. The data at risk is whatever is in Copilot’s context for that user. The report mentions content from Outlook and SharePoint.
Response
Microsoft fixed the issue on its side. The report states that no customer action is required. Microsoft described the issue in its advisory as AI command injection that lets an unauthorized attacker disclose information over a network, and included it in its June 2025 security updates.
Mitigations
Not stated by the source.
Sources
- CVE-2025-32711 (Microsoft Security Update Guide)primary · 2025-06-11
- Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interactionsecondary · 2025-06-12
Corrections
No corrections have been made to this entry.
Report a correction