Threat
CVE-2025-32711 脆弱性：「EchoLeak」Microsoft 365 Copilot の欠陥により AI エージェントへのゼロクリック攻撃の可能性
First reported · Discovered socprime.com
Page published
Earliest dated coverage: 12 Jun 2025 · First observed: 16 Oct 2026 · Latest dated coverage: 12 Jun 2025
Coverage timeline
Single-source incident — one report is available.
Why it matters
EchoLeak exposes the risk of email content crossing an AI assistant’s trust boundaries and enabling sensitive-data theft without a user click.
EchoLeak (CVE-2025-32711) is a reported Microsoft 365 Copilot vulnerability that enables attackers to steal sensitive data through email without user interaction. SOC Prime describes the mechanism as an “LLM scope violation”; the supplied excerpt does not establish active exploitation or a demonstrated proof of concept.