EchoLeak Vulnerability: Zero-Click Prompt Injection Leads to Silent Data Leakage of Microsoft 365 Copilot

Event Overview

In June 2026, a security research team disclosed a zero-click vulnerability numbered CVE-2025-32711, codenamed EchoLeak, affecting Microsoft 365 Copilot. The vulnerability allows an attacker to exfiltrate sensitive data from an enterprise's internal Copilot environment without the user's knowledge through a carefully crafted email. Microsoft released a server-side patch in May 2026, but as of the time of this writing, no in-the-wild exploitation cases have been confirmed. However, the technical complexity and potential impact of this vulnerability are significant, warranting high attention from all organizations deploying AI assistants.

Technical and Risk Analysis

EchoLeak is an indirect prompt injection attack that exploits the context inheritance mechanism of Retrieval Augmented Generation (RAG) systems. The attack chain is as follows:

1. Injection Phase: The attacker sends a seemingly normal email to the target user, but embeds malicious prompts within HTML comments or white font text. These prompts are invisible to the user but are parsed and stored by Copilot's LLM engine. 2. Trigger Phase: When the user normally uses Copilot (e.g., requesting summaries, analyses, or information retrieval in Word, Outlook, or Teams), Copilot's RAG engine includes historical emails (including those containing hidden prompts) in the context window. 3. Execution Phase: The hidden prompts are executed by the LLM, instructing Copilot to return internal enterprise sensitive data such as email content, document summaries, Teams messages, etc., and present them to the user as normal responses. Data can also be exfiltrated via Markdown links or images, bypassing standard editing measures.

Attackers can increase the probability of success using "RAG spraying": sending multiple emails with prompts to multiple users; if any one email is included in the context, the attack may succeed.

• The vulnerability bypasses multiple Microsoft security mechanisms:
• XPIA Bypass: Evades detection by the cross-prompt injection attack classifier.
• Link/Image Editing Bypass: Uses reference-style Markdown to circumvent content filtering.
• CSP Bypass: Exploits allowed domains (e.g., SharePoint, Teams) to bypass Content Security Policy.

According to the MITRE ATT&CK mapping, this attack involves T1566.001 (Spearphishing Attachment), T1056 (Input Capture via Context Manipulation), and T1567 (Exfiltration Over Web Service).

Enterprise Impact AnalysisEchoLeak poses comprehensive risks to enterprises: - Operational Risk: Attackers can stealthily steal strategic documents, internal meeting records, customer data, etc., disrupting business decision-making processes. - Data Risk: Any data accessible to Copilot—including OneDrive, SharePoint, Exchange, Teams—may be leaked. - Compliance Risk: Under regulations such as GDPR and CCPA, data breaches can lead to hefty fines and regulatory scrutiny. - Brand Risk: Even if not exploited publicly, potential vulnerabilities can erode trust from customers and partners. - Financial Risk: According to IBM, the average cost of a data breach exceeds $4 million, and AI-related attacks could be even higher.

Especially for finance, legal, healthcare, government, and high-tech industries, due to the handling of highly sensitive information, the risk level should be rated as severe.

Industry Trend Observations

EchoLeak is not an isolated incident but a microcosm of new AI security challenges. As enterprises widely deploy RAG-based AI assistants (such as Copilot, ChatGPT Enterprise, etc.), prompt injection attacks are moving from theory to reality. Similar attacks have been proven feasible on other platforms, including PDF injection, document poisoning, etc.

• This trend indicates:
• Traditional security boundaries are broken: The context inheritance of LLMs breaks the isolation between emails, documents, and queries.
• Zero-click attacks become a new paradigm: Users can be attacked without clicking links or opening attachments.
• Supply chain risks extend to the AI ecosystem: The security of third-party AI plugins will directly affect the enterprise environment.

Enterprises must incorporate AI security into their overall security architecture and adopt a zero-trust principle for every model interaction.

Defense and Response Recommendations

Enterprise Level - Apply patches immediately: Ensure Microsoft 365 Copilot is updated to the May 2026 server-side patch or later. - Restrict context sources: Use administrative settings to prohibit Copilot from accessing external emails or limit document scope. - Implement the principle of least privilege: Ensure Copilot can only access the minimum data needed to perform tasks.

Technical Level - Deploy an AI security gateway: Monitor and intercept suspicious AI outputs at the network layer, detecting abnormal data exfiltration. - Strengthen email security: Use AI-driven email security solutions to identify hidden prompts (e.g., HTML comments, white font text). - Enable logging and auditing: Record Copilot queries and responses for post-incident forensics.### Management Level - Develop AI Incident Response Plan: Incorporate prompt injection attacks into IR playbooks, clearly defining detection, containment, and recovery steps. - Conduct Security Awareness Training: Educate employees to be vigilant against abnormal Copilot responses, such as unsolicited data summaries. - Regular Risk Assessments: Perform specialized risk assessments for AI assets, with a particular focus on third-party integrations.

SecurityPost Insight

The EchoLeak vulnerability reveals a fundamental flaw in the current AI assistant security architecture: the RAG system indiscriminately trusts contextual content. Although Microsoft fixed it promptly, similar risks will continue to appear in other LLM applications. Enterprise decision-makers need to recognize that AI security is not a technical issue that can be solved with patches, but a strategic issue that requires redesigning trust models and data flow architectures.

In the future, we anticipate more attack techniques targeting RAG systems, including multimodal prompt injection and cross-application context contamination. It is recommended that organizations immediately assess their AI supply chains, establish continuous threat monitoring, and actively participate in information sharing within the industry security community. Only by embedding AI security into business continuity plans can resilience be maintained against the next generation of threats.

---

• References:
• Rescana Security Research Team Disclosure: https://www.rescana.com/post/cve-2025-32711-zero-click-echoleak-vulnerability-in-microsoft-365-copilot-enables-stealth-data-exfiltration-via-prompt-i
• Microsoft Security Response Center: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711
• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-32711