Case echoleak-m365-copilotPrompt injectionWorldwide
EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)
Aim Security showed a crafted email could make M365 Copilot silently exfiltrate tenant data with no clicks; Microsoft fixed it server-side, CVSS 9.3, no in-the-wild abuse reported.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 11, 2025
- Location
- Worldwide
- Target
- Microsoft 365 Copilot
- Severity
- High
- Triggered by
- Security researchers at Aim Security (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2025-32711
What happened
Aim Security showed a crafted email could make M365 Copilot silently exfiltrate tenant data with no clicks; Microsoft fixed it server-side, CVSS 9.3, no in-the-wild abuse reported.
Impact: Proof-of-concept only: could silently exfiltrate emails, files and chat context from a Microsoft 365 tenant; no evidence of in-the-wild exploitation
Who triggered it
Actor: Security researchers at Aim Security (responsible disclosure)
Attribution: Self-disclosed by Aim Security; vulnerability confirmed and rated critical by Microsoft (MSRC)
Motive: Security research; no malicious exploitation reported
How it happened
Attack vector: Indirect prompt injection via a crafted inbound email that Copilot ingests through RAG, exfiltrating data via an allowlisted Teams image proxy while bypassing the XPIA classifier and link redaction
Root cause: LLM scope violation: untrusted email content could steer Copilot into reading privileged tenant data and emitting it in outbound requests without user interaction
Timeline
- Aim Security discovers the zero-click chain and reports it to Microsoft
- Microsoft deploys a server-side fix (some reports place final remediation in June)
- CVE-2025-32711 published (CVSS 9.3); Aim Security publishes EchoLeak research
Response
Microsoft fixed the issue server-side with no customer action required and assigned a critical CVE; Aim criticised the roughly five-month remediation time
Current status: Patched
Sources (open in a new tab)
- SOC Prime socprime.com
- The Hacker News thehackernews.com
- Hack The Box hackthebox.com
Cite this case
EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711). AI Threat Watch, case echoleak-m365-copilot, Jun 11, 2025. https://aithreat.io/cases/echoleak-m365-copilot/
Permanent link: https://aithreat.io/cases/echoleak-m365-copilot/