EchoLeak: Zero-Click Vulnerability in Microsoft 365 Copilot
Researchers discovered EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot that could have allowed attackers to steal sensitive data via specially crafted emails without user interaction. Microsoft fixed the vulnerability server-side in May 2025 and confirmed no customers were impacted.
What happened
Researchers at Aim Labs discovered a zero-click vulnerability, dubbed EchoLeak, in Microsoft 365 Copilot in January 2025. The vulnerability allowed attackers to steal sensitive data from a user's environment by sending a specially crafted email containing hidden prompts in markdown syntax.
When users asked Copilot related questions, the system would retrieve the malicious email via its Retrieval-Augmented Generation engine. The hidden prompt would then instruct the AI to extract internal data and place it in links or images that automatically triggered outbound requests to attacker-controlled servers without user interaction.
Reported impact
The vulnerability could have exposed internal memos, strategic documents, and personal identifiers. Microsoft confirmed that no customers were impacted and there is no evidence the flaw was exploited in real-world attacks.
Index analysis
EchoLeak is described as the first-ever zero-click AI vulnerability affecting a large language model-based assistant. The attack exploited an LLM Scope Violation where the assistant could be manipulated into leaking information beyond its intended context, bypassing Copilot's Cross-Prompt Injection Attack defenses through reference-style markdown formats.
Governance controls
Microsoft fixed the vulnerability server-side in May 2025, requiring no action from users. The fix involved addressing how the assistant processes information from emails and documents when answering user questions.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.