EchoLeak: zero-click data theft from Microsoft 365 Copilot (2025)

The system

Microsoft 365 Copilot is an assistant embedded across Outlook, OneDrive, SharePoint and Teams. It answers questions by retrieving the employee's own email, files and chat history (a RAG pipeline) and composing a response, which can include markdown links and images rendered automatically in the Copilot UI. Any employee with Copilot enabled can receive email, and Copilot treats a user's inbox as part of its retrievable context.

What was observed

Aim Labs privately disclosed a vulnerability to Microsoft in January 2025. Microsoft shipped a server-side fix in May 2025, and the advisory (CVE-2025-32711) went public on 11 June 2025 with a CVSS score of 9.3. The reported effect: an attacker could cause Copilot to exfiltrate sensitive data from a victim's own Microsoft 365 account by sending a single email. The victim did not need to open, read, or click anything in that email.

Stop and think

1. If the attacker needs zero interaction from the victim, where does the attacker-controlled content actually enter the model's context, and what has to go wrong for Copilot to treat it as instructions rather than data?
2. Copilot's output goes through a markdown link filter before being shown to the user. If a filter catches the common case, what classes of malformed or alternate syntax might it miss?
3. Once Copilot has retrieved private data and wants to put it somewhere the attacker can read it, what does the actual network request look like, and why would the browser make it without asking the user first?