{"id":76,"date":"2026-10-29T06:45:28","date_gmt":"2026-10-29T06:45:28","guid":{"rendered":"https:\/\/bugskan.com\/?p=76"},"modified":"2026-10-29T06:45:29","modified_gmt":"2026-10-29T06:45:29","slug":"echoleak-what-a-historical-zero-click-copilot-flaw-teaches-about-trust-boundaries","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/echoleak-what-a-historical-zero-click-copilot-flaw-teaches-about-trust-boundaries\/","title":{"rendered":"EchoLeak: what a historical zero-click Copilot flaw teaches about trust boundaries"},"content":{"rendered":"<p>EchoLeak, tracked as CVE-2025-32711, was a prompt-injection issue in Microsoft 365 Copilot. A 2025 academic case study examines how a crafted email could lead to data exfiltration without additional user interaction.<\/p>\n<p>The analysis describes a chain of bypasses involving input classification, Markdown links, automatically fetched images, and a trusted proxy. A control that blocked one representation did not necessarily block another route to the same outcome.<\/p>\n<p>This retrospective concerns a disclosed vulnerability, not a new claim that every Copilot tenant is currently compromised. The practical lesson for agent builders is to preserve the distinction between external content and authorized instructions throughout retrieval, rendering, and tool execution. Review permissions and outbound data paths, not only the wording of the system prompt.<\/p>\n<p><a href=\"https:\/\/ojs.aaai.org\/index.php\/AAAI-SS\/article\/view\/36899\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A published case study examines how an email could cross an AI assistant\u2019s data-access boundaries.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_1719ecaddb5e26","bugskan_event_type":"research","bugskan_response":"unknown","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"","bugskan_recommended_next_step":"","bugskan_who_should_check":"","bugskan_material_updated_at":"2025-11-23T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[3],"bugskan_technology":[],"class_list":["post-76","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-research-explained"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=76"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":312,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/76\/revisions\/312"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=76"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=76"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}