This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email. By chaining multiple bypasses -- evading Microsoft's XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy -- EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction.
Curated from arxiv.org · 6 September 2025 →
Aim Labs reported EchoLeak to Microsoft in January 2025 and it was disclosed in June as CVE-2025-32711, rated 9.3. The attack is one email. The recipient does not have to open it, click anything or even see it: Copilot indexes the mailbox, reads the hidden instructions in the message, and then follows them the next time the employee asks Copilot an unrelated question, pulling data out of the company's own Microsoft 365 tenant. Microsoft patched it server-side and says it has no evidence of exploitation. This paper is the academic writeup of the chain; it matters because every defence in it was already deployed and each one was bypassed in turn.
