EchoLeak Explained: The Zero-Click M365 Copilot Exploit

EchoLeak is a zero-click prompt-injection vulnerability in Microsoft 365 Copilot, tracked as CVE-2025-32711 and disclosed by Aim Security in June 2025. An attacker could send a crafted email to someone in an organisation; when that person later asked Copilot an ordinary question, Copilot's retrieval pulled the email into context, followed its embedded instructions, and placed internal data into a URL that the client fetched automatically. The victim did not need to open the email or click anything. Microsoft fixed the issue server-side before public disclosure, so customers did not have to act, but the chain is a clear blueprint of how a retrieval-augmented assistant becomes an exfiltration path.

What the CVE record says

The National Vulnerability Database entry for CVE-2025-32711, published on 11 June 2025, describes the issue as "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network." Microsoft, as the CVE Numbering Authority, scored it 9.3 (critical) under CVSS 3.1, with a network attack vector, low complexity, no privileges required, no user interaction and changed scope, and classified it under CWE-74, improper neutralisation of special elements in output used by a downstream component — the injection weakness family.

"No user interaction" is the part that earned the zero-click label. Earlier Copilot and chatbot exfiltration research usually needed the user to click a link. EchoLeak removed that step.

How the attack chain worked

Aim Security's write-up described a sequence of individually small bypasses, each defeating one control. In outline:

Delivery by email. The attacker sends an email to a target in the organisation. No reply or open is needed; Copilot can retrieve mailbox content as grounding data.
Evading the injection classifier. Microsoft runs classifiers meant to catch cross-prompt injection. The researchers phrased the malicious instructions as if addressed to the human recipient, not to an AI, which let the email pass as ordinary business text.
Retrieval brings it into context. When the user asks Copilot something the email is plausibly relevant to, retrieval selects it and places it alongside sensitive content from the user's mailbox, files or chats.
The model follows the instructions. The injected text tells Copilot to include the most sensitive information from its context in a link or image reference pointing to an attacker-controlled address.
Bypassing link redaction. Copilot removed external links in standard markdown, but reference-style markdown links and images were not handled the same way, according to the researchers.
Zero-click exfiltration through an image. A markdown image is fetched by the client as soon as the response renders. The data rides in the image URL's query string.
Getting past the content security policy. The client's policy restricted which domains images could load from. The researchers used allowed Microsoft domains whose endpoints would forward the request onward, so the fetch looked permitted.

Aim Security named the underlying class an "LLM scope violation": untrusted input from outside the organisation causes the model to access and emit data from a more privileged scope. Microsoft said it had found no evidence of exploitation in the wild.

EchoLeak maps exactly to the lethal trifecta

The lethal trifecta says an agent becomes an exfiltration risk when it combines three things. EchoLeak had all three:

Trifecta leg	In EchoLeak	Control that would remove or weaken it
Exposure to untrusted content	Any external sender can put an email into the mailbox Copilot retrieves from	Separate or tag external content in retrieval; exclude it from contexts that also hold sensitive data
Access to private data	Copilot grounds answers in the user's mail, files and chats	Limit what a single answer can draw on; apply sensitivity labels and data-loss controls to grounding
Ability to communicate externally	Rendered images and links fetched URLs automatically	Do not auto-render external images; allow-list destinations strictly; strip data from outbound URLs

The table also shows why no single control was enough. Microsoft had a classifier for the first leg, link redaction and a content security policy for the third leg, and each was bypassed by a different trick. Filters that try to recognise malicious content are probabilistic. Removing a leg is structural.

Which controls would have broken the chain

Read EchoLeak as a list of checkpoints, each of which could have stopped it on its own:

Output inspection for data in URLs. A guardrail on the model's response that flags or removes URLs carrying query-string data, or any URL to a non-allow-listed host, ends step 6 regardless of how the instruction got in.
No automatic fetches of model-generated resources. If the client never auto-loads images the model emits, the zero-click property disappears and the attack needs a click.
Strict, purpose-built egress allow-lists. An allow-list that includes general-purpose endpoints able to proxy or redirect is not an allow-list. ForcedLeak, covered in ForcedLeak and PipeLeak explained, failed on the same point with an expired allow-listed domain.
Treat retrieved content as untrusted. External email in a retrieval index is attacker-controlled input; the indirect prompt injection threat model explains why it must not carry instruction authority.
Scope what one answer can combine. Keeping untrusted external content out of contexts that also contain confidential data removes the first or second leg.
Log retrieval and output together. Recording which sources fed an answer, and what the answer contained, lets you find and scope an incident later.

What it means for teams running Copilot and other assistants

EchoLeak was patched centrally, and there is no Copilot setting to change for it now. The lesson is about any assistant or agent that grounds answers in a mailbox, a document store or a ticket queue that outsiders can write to. Ask three questions of each one: can an outsider get text into what it reads; can it read something confidential in the same turn; and can its output reach the network without a human acting? If all three are yes, assume the next EchoLeak-style chain is a matter of finding the right bypass.

For Microsoft 365 specifically, the governing Microsoft 365 Copilot agents post covers the Graph-grounded permission model and where maker-published Copilot Studio agents change the picture. Oversharing in SharePoint and mailbox access is what determines how much an EchoLeak-style chain could reach.

How Praesidia fits: discover, secure, prove

Praesidia does not sit inside Microsoft's first-party Copilot service, and it would not have patched this CVE; Microsoft did. Its value is for the agents you build and connect. Discover: inventory which agents exist and which MCP servers, tools and data sources each can reach, so you can see which ones hold all three trifecta legs. Secure: guardrails inspect content on the input and output of agent tasks and can block, redact or warn, so a response carrying data to an unexpected URL can be stopped at the output boundary; tool access runs through scoped connections and tool policy, and consequential actions can be gated for human approval. Prove: calls and guardrail evaluations that pass through Praesidia are recorded with attribution, which gives an incident review the trail EchoLeak-style investigations need.

Common questions

Do I need to do anything about CVE-2025-32711 today? Microsoft fixed it in the service and stated no customer action was required. Check Microsoft's security update guide for current status rather than relying on a point-in-time summary.

Was EchoLeak exploited? Microsoft said it found no evidence of exploitation in the wild at disclosure.

Why is it called zero-click? The victim only had to ask Copilot a normal question. Rendering the response fetched the attacker's image URL automatically, so no link click was needed.