Research explained
EchoLeak: what a historical zero-click Copilot flaw teaches about trust boundaries
A published case study examines how an email could cross an AI assistant’s data-access boundaries.
What happened
EchoLeak, tracked as CVE-2025-32711, was a prompt-injection issue in Microsoft 365 Copilot. A 2025 academic case study examines how a crafted email could lead to data exfiltration without additional user interaction.
The analysis describes a chain of bypasses involving input classification, Markdown links, automatically fetched images, and a trusted proxy. A control that blocked one representation did not necessarily block another route to the same outcome.
This retrospective concerns a disclosed vulnerability, not a new claim that every Copilot tenant is currently compromised. The practical lesson for agent builders is to preserve the distinction between external content and authorized instructions throughout retrieval, rendering, and tool execution. Review permissions and outbound data paths, not only the wording of the system prompt.
What we know
- Affected service in historical research
- Microsoft 365 Copilot
- Evidence type
- Published case study
What remains unknown
- Open question
- This retrospective does not determine the security state of a current tenant.
Source references
-
OJS
Technical details
- CVE
CVE-2025-32711