Threat
EchoLeak: The Zero-Click Copilot Data Leak | Certified Agentic AI Security Expert
Publication date unknown · Discovered youtube.com
Page published · Page updated
Publication date unknown · First observed: 16 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
EchoLeak demonstrates how treating retrieved email as trusted instructions can turn an enterprise AI assistant into a data-exfiltration channel without user interaction with the malicious message.
EchoLeak (CVE-2025-32711) was a zero-click prompt-injection flaw in Microsoft 365 Copilot that used hidden instructions in retrieved email to exfiltrate data without the recipient opening the message. The video description credits Aim Security with discovery and reports that Microsoft patched the flaw in June 2025.
Summary
EchoLeak is described as a zero-click prompt-injection vulnerability in Microsoft 365 Copilot, tracked as CVE-2025-32711 with a reported CVSS score of 9.3. The supplied Practical DevSecOps video description credits Aim Security with the discovery and states that Microsoft patched the vulnerability in June 2025. These findings are supported by a single secondary-source description.[0]
The described attack uses a normal-looking email carrying hidden instructions. When a user later asks Copilot a work question, Copilot reads the email as context and the instructions cause data to be sent out; the user does not need to open the email. The account supports a vulnerability-research narrative rather than an observed campaign: it supplies no named malicious actor, victim reporting, or evidence of in-the-wild exploitation.[0]
Attack chain
- 1. Delivery through email: An attacker sends a normal-looking email containing hidden instructions.[0]
- 2. Retrieval during a work query: The user later asks Copilot a work question, and Copilot reads the attacker-supplied email as context. The description states that the user never opens the email.[0]
- 3. Instruction-driven data leakage: The hidden instructions cause data to be sent out. The supplied description does not specify the destination, transport mechanism, or exact data exposed.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2025-06 | Microsoft reportedly patched EchoLeak. The supplied description does not provide a specific day or a separate disclosure date.[0] |
How it works
The prompt-injection entry point is an email that Copilot retrieves as contextual material for a subsequent work question. The malicious instructions reside in that email rather than in a direct user request to Copilot.[0]
The description attributes the data leakage to Copilot acting on hidden instructions in the retrieved email. Its zero-click characterization is tied to the absence of any requirement for the user to open that email; an ordinary work question is still part of the described sequence.[0]
The supplied account gives a high-level mechanism, not a reproducible exploit specification. It does not provide the injection text, an exfiltration endpoint, or technical details of the data-transfer mechanism.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Microsoft 365 Copilot | Identified as the affected product; no affected build numbers or release range are supplied. | Reported patched by Microsoft in June 2025. The description does not identify an update package or deployment details.[0] |
Key takeaways
- The described trigger is retrieval during normal Copilot use, not the recipient opening the malicious email. That distinction is central to the source's zero-click characterization.[0]
- The reported remediation milestone is June 2025, but the supplied description does not establish affected-version boundaries or deployment details.[0]
- The evidence supports a high-level explanation of a patched prompt-injection vulnerability, not attribution of a campaign or a conclusion that exploitation occurred in the wild.[0]
Defensive actions
- Treat content retrieved by agents, including email, as untrusted input rather than authoritative instructions.: The source explicitly recommends this boundary. In the described attack, hidden instructions in an email become consequential when Copilot reads the email as context.[0]
- Restrict outbound links available to agents.: The source recommends outbound-link restrictions alongside its description of hidden instructions causing data to be sent out. It does not specify a particular filtering implementation.[0]
- Prevent external data from receiving internal privileges in agent workflows.: The source explicitly identifies this design requirement in response to an attack that uses externally supplied email content to influence Copilot's behavior.[0]