A single email, never opened, never clicked, was enough to pull sensitive internal data out of a Microsoft 365 Copilot deployment. That is the core fact behind EchoLeak (CVE-2025-32711), a vulnerability disclosed by Aim Security and publicly described as the first real-world zero-click prompt injection exploit against a production LLM system. It carries a CVSS score of 9.3, and while Microsoft has stated there is no evidence it was exploited in the wild before the fix shipped, the mechanics of the bug are worth understanding in detail, because they describe a class of risk that will recur anywhere an LLM is wired into broad internal data access.
What happened
Copilot's retrieval pipeline is designed to pull relevant context from a user's mailbox, documents, and chats to answer questions. EchoLeak abused that design directly. A single crafted email, requiring no interaction from the recipient, contained content structured so that when Copilot's retrieval-augmented generation (RAG) pipeline later ingested it as part of answering an unrelated user query, the model treated the attacker's embedded instructions as legitimate input to act on.
Getting from "malicious email sits in an inbox" to "data leaves the organization" required chaining together several separate bypasses in the same exploit: Microsoft's XPIA (cross-prompt-injection) classifier, which is specifically built to catch this kind of attack, failed to flag the crafted content; the email's links passed through Copilot's link-redaction protections via reference-style Markdown formatting that evaded the filter; auto-fetched images embedded in the response gave the attacker a mechanism to transmit data outward without needing the user to click anything; and a Teams proxy allowed under the application's content security policy (CSP) provided an approved-looking egress channel for the exfiltrated content. Each of these was a defense that, on its own, looked reasonable. Chained together, they produced a path from a sitting email to exfiltrated internal data with zero clicks and zero user awareness.
The affected surface was broad because it followed Copilot's own integration footprint: Word, Excel, PowerPoint, Outlook, and Teams. Microsoft shipped a server-side patch in its June 2025 Patch Tuesday window, which meant no customer-side action was required to close the hole — a meaningful point in Copilot's favor, since it indicates the fix could be applied centrally rather than depending on every tenant to deploy something.
Why zero-click changes the risk category
Most prompt injection research and most real-world phishing-adjacent LLM attacks still depend on getting a user to do something: open a suspicious document, paste untrusted text into a chat window, approve an action, click a link. That dependency is also the primary control surface defenders rely on — user training, suspicious-link warnings, attachment sandboxing, and simple user skepticism all sit on top of the assumption that a human has to participate at some point in the chain.
EchoLeak eliminates that assumption. The victim did not need to open the email, click a link, or approve anything. Copilot's own background retrieval process was the vector — the very feature that makes an AI assistant useful, its ability to reach across a user's data automatically, was also what carried the attack. This is a fundamentally different threat model from typical phishing-style prompt injection, and defenses built around user behavior simply do not apply to it. A zero-click flaw in a system with retrieval access to internal data functions much closer to a traditional zero-click remote exploit than to a social-engineering attack, even though the payload's mechanism is prompt injection rather than memory corruption.
What this demonstrates about LLM-to-data-access architecture
EchoLeak is a useful case study precisely because none of its individual components were novel or exotic. Classifiers that miss cleverly-formatted input, redaction filters that can be reformatted around, auto-fetch behavior that assumes fetched content is passive, and CSP allowlists that are broader than strictly necessary are all familiar categories of imperfect controls. What EchoLeak shows is that when an LLM sits at the center of a pipeline with reach into a large internal data set, the aggregate risk of that pipeline is the product of every defense working simultaneously, not the sum of them. A single miss in any one layer, when the layers are chained by a capable attacker, is enough.
The deeper lesson for anyone building or operating LLM systems with access to sensitive internal data is that output-handling controls deserve at least as much scrutiny as input-handling controls. Prompt injection defenses tend to focus on filtering what goes into the model. EchoLeak succeeded by getting the model to act on injected instructions and then exploiting under-scrutinized output paths — auto-fetched images, a permitted proxy — to get data back out. An organization can have solid input filtering and still be exposed if the paths data can travel out through are not equally locked down.
What to check this week
- Inventory every automatic data-fetch and retrieval feature connected to your LLM deployments. Anything that pulls content in without a user explicitly requesting it — email ingestion, auto-summarization, background indexing — is a potential injection vector, whether or not you use Copilot specifically.
- Review your CSP and network egress allowlists for AI-integrated applications, and confirm that every allowed proxy or destination is actually necessary rather than inherited from a broader default policy.
- Ask your vendor how their prompt-injection classifiers were validated against formatting-based evasion, such as reference-style Markdown or other encodings that can dodge naive pattern matching, since XPIA's miss here was a formatting bypass, not a semantic one.
- Confirm patch status on any Copilot deployment — Microsoft's fix was server-side, so exposure at this point should be limited to tenants that have not yet received the June 2025 update.
Why disclosure quality matters here
Aim Security's disclosure, and Microsoft's response of a server-side patch with an explicit statement of no observed in-the-wild exploitation, represents close to a best-case outcome for a vulnerability this severe: found by a legitimate research firm, fixed centrally, and apparently caught before attackers found it independently. That should not be read as reassurance that zero-click LLM injection is a solved problem — it is closer to a warning shot that the same class of chained bypass is achievable across other RAG-based products, most of which have not had the benefit of a dedicated external security research team probing them.
How Safeguard helps
Safeguard's focus is on the software supply chain and dependency layer that increasingly includes AI/ML tooling and MCP integrations, rather than on Copilot itself. But EchoLeak is directly relevant to how we think about that surface: any AI-integrated component your organization installs or connects, including third-party MCP servers, deserves the same "what can it read, and what can it send data to" scrutiny that this incident retroactively applied to Copilot. Safeguard's SBOM and dependency visibility work is aimed at making that question answerable before an incident forces it, and our MCP Guardrail work specifically targets the pattern of granting broad data access to an AI-connected integration without matching security review of what that access actually permits.
