EchoLeak: The Zero-Click Flaw in Microsoft 365 Copilot

In June 2025, the research firm Aim Security disclosed EchoLeak, a vulnerability in Microsoft 365 Copilot that Microsoft catalogued as CVE-2025-32711 and rated critical. Its significance is in one word: zero-click. The victim did not have to open a malicious message, click a link, or do anything at all.

The attack begins with an ordinary email. Inside it, the attacker hides instructions where a human will not notice them — for instance in text styled to be invisible, or tucked into HTML that renders blank. The email lands in the victim's mailbox and simply waits. No interaction is required, which is what makes EchoLeak categorically nastier than the prompt-injection demonstrations that came before it.

How the data leaves

The trigger is the victim using Copilot for something unrelated. When the user asks Copilot a normal question, Copilot retrieves relevant context from their environment — including, potentially, that email. The hidden instructions enter the model's context and are treated as commands. Aim Security described the result as an LLM scope violation: the attacker's text steers Copilot into gathering sensitive internal data the user can access and smuggling it out to an attacker-controlled destination, all inside a legitimate-looking interaction.

Report the outcome accurately

Microsoft addressed EchoLeak server-side. It assigned CVE-2025-32711 with a critical severity, published an advisory, stated that no customer action was required, and said it had no evidence the flaw was exploited in the wild. In other words: disclosed responsibly, fixed centrally, no known victims. That is the fair summary, and it is also what makes the case useful — it is a clean look at a new attack class rather than a breach post-mortem.

The reason EchoLeak should worry architects is that it exploited the assistant's core design, not a coding slip. Copilot is valuable because it reads your context and acts on it; EchoLeak turned exactly that property into an exfiltration channel. Fixing one instance does not retire the class. Any assistant that ingests attacker-reachable content and can reach sensitive data is a candidate for the same pattern.

It is worth being precise about why "zero-click" is the load-bearing word. Earlier prompt-injection demonstrations required the victim to do something — open a document, paste a page, follow a link — which gave defenders a behaviour to warn against and a choke point to control. EchoLeak removed the human from the loop entirely: the malicious email only has to arrive and sit unread until the victim's ordinary use of Copilot pulls it into context. There is no risky action to train users away from, because the risky action is the assistant doing its job. The uncomfortable corollary is that patching individual instances does not close the category — as long as an assistant ingests attacker-reachable content and can reach both sensitive data and an outbound channel, the ingredients for a scope violation are present. Defence has to be architectural, treating the assistant's context as a trust boundary, rather than a game of fixing one bypass at a time.

What defenders should take away

• Treat inbound content as attacker-controlled input to the model. Email and shared documents can carry instructions; isolate that text and prevent it from being interpreted as commands.
• Close exfiltration paths. Constrain the destinations an assistant can reach or reference, so injected instructions have nowhere to send data.
• Scope what the assistant can retrieve. Least-privilege context limits what a scope violation can gather in the first place.
• Map assistant reach before deployment. The blast radius of a zero-click prompt attack equals what the assistant can see and where it can send — know both.

EchoLeak marks the moment prompt injection graduated from a demo requiring a gullible click to a zero-click threat requiring nothing from the victim. Getting ahead of it means understanding every place an AI assistant ingests outside content and every place it can reach — because you cannot defend what you have not discovered.