News report
Microsoft 365 Copilot: New Zero
Researchers have uncovered "EchoLeak," a critical zero-click vulnerability in Microsoft 365 Copilot that exploits design flaws inherent to Retrieval Augmented Generation (RAG) applications. This flaw, leveraging an "LLM Scope Violation" technique, allows for the automatic exfiltration of sensitive corporate data from the LLM's context without requiring user interaction.
What Happened
Researchers have uncovered "EchoLeak," a critical zero-click vulnerability in Microsoft 365 Copilot that exploits design flaws inherent to Retrieval Augmented Generation (RAG) applications. This flaw, leveraging an "LLM Scope Violation" technique, allows for the automatic exfiltration of sensitive corporate data from the LLM's context without requiring user interaction.
Why This Matters
This is source reporting of a security event, not a confirmed product vulnerability or patchable CVE. Use it as situational awareness if named organizations, cloud tenants, or identity systems overlap with yours.
Recommended Action
Read the source report. Confirm whether any named organizations, identity tenants, or cloud environments you operate are implicated. Do not treat this as a vendor advisory unless a CVE or official bulletin is attached.
Exposure
Exposure unknown
Jun 13, 2025 05:30
Exposure reason: This incident does not currently match a technology in My AI Stack.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Jun 13, 2025 05:30BugSkan first recorded this incident.
-
Microsoft 365 Copilot: New Zero-Click AI Vulnerability Allows Corporate Data Theft - Infosecurity Magazine
Jun 13, 2025 05:30infosecurity-magazine.com · News
Sources
infosecurity-magazine.com · Jun 13, 2025 05:30
Researchers have uncovered "EchoLeak," a critical zero-click vulnerability in Microsoft 365 Copilot that exploits design flaws inherent to Retrieval Augmented Generation (RAG) applications. This flaw, leveraging an "LLM Scope Violation" technique, allows for the automatic exfiltration of sensitive corporate data from the LLM's context without requiring user interaction.
Open publisher sourceMy AI Stack Match
Create an account to see which incidents overlap with your AI stack.