EchoLeak: zero-click prompt injection in Microsoft 365 Copilot exfiltrates internal data (CVE-2025-32711)
Microsoft (365 Copilot) · Jun 11, 2025 · General agent
What happened
Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), a zero-click indirect prompt injection in Microsoft 365 Copilot: a single crafted email, with no user interaction, could make Copilot retrieve internal files and exfiltrate their contents to an attacker-controlled server. Microsoft patched the flaw server-side in its June 2025 update cycle and said it found no in-the-wild exploitation.
Causal vector
Malicious instructions embedded in an inbound email were pulled into Copilot's RAG context and obeyed — no click required
Source
Reported by Microsoft Security Response Center. Verified against the primary report.
EchoLeak worked because the agent's outbound action (fetching an attacker URL with data in it) was trusted by default. An egress allowlist enforced outside the model — the merchant-allowlist pattern applied to network destinations — returns BLOCKED on any callback to an unapproved server, whatever the injected email says.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection
Google · Nov 25, 2025
State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools
Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Windsurf (Cascade) · Aug 21, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.