Emma Roth
Security researchers found a zero-click vulnerability in Microsoft 365 Copilot.
The vulnerability, called “EchoLeak,” lets attackers “automatically exfiltrate sensitive and proprietary information” from Microsoft 365 Copilot without knowledge of the user, according to findings from Aim Labs.
An attacker only needs to send their victim a malicious prompt injection disguised as a normal email, which covertly instructs Copilot to pull sensitive information from a user’s account.
Microsoft has since fixed the critical flaw and given it the identifier CVE-2025-32711. It also hasn’t been exploited in the wild.
Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot
[bleepingcomputer.com]
