Zero-click email attack pulled data out of Microsoft 365 Copilot

Microsoft 365 Copilot could be made to leak internal data to an outside attacker by sending a user one crafted email, according to research published by Aim Security in June 2025. The flaw, tracked as CVE-2025-32711 and nicknamed EchoLeak, needed no click from the victim. Microsoft patched it server-side in May 2025 and said no customers were known to have been affected.

The attack worked by hiding instructions inside an ordinary-looking email. When a user later asked Copilot a question, the assistant retrieved the email as context, followed the embedded instructions, gathered sensitive content from the user's mailbox and files, and embedded it in a link or image reference that sent the data to a server controlled by the attacker.

Aim Security described the technique as an "LLM scope violation": untrusted content from outside the organisation ended up steering an assistant that had access to privileged internal data. The researchers said they bypassed Microsoft's prompt-injection classifiers by phrasing the instructions as if they were written for a human reader, and used Microsoft-owned domains that Copilot was allowed to reference to carry the stolen data out.

Microsoft assigned the vulnerability a critical severity rating and a CVSS score of 9.3. The company said the issue was fully mitigated and required no customer action.

The case is widely cited as the first zero-click exfiltration chain demonstrated against a mainstream enterprise AI assistant. It also illustrated a pattern that has recurred in later incidents: an agent that reads untrusted input, has access to private data, and can make outbound requests is exposed to data theft unless one of those three capabilities is removed or tightly controlled.