EchoLeak zero-click prompt injection let a single email exfiltrate Microsoft 365 Copilot data

Microsoft 365 Copilot customers·Microsoft 365 CopilotFixed

A single crafted email containing a hidden prompt (invisible HTML/markdown text) was ingested by Copilot's RAG engine and used to chain XPIA-classifier evasion, markdown link/image redaction bypass, and a Teams-proxy CSP bypass to make Copilot silently exfiltrate sensitive data from Word, Excel, Outlook, and Teams, with zero clicks from the victim.

Blast radius

Any data reachable in Copilot's context window (emails, chats, OneDrive/SharePoint files) was exfiltratable; tracked as CVE-2025-32711, no confirmed in-the-wild exploitation reported at disclosure.

Root cause

RAG systems inherit and execute instructions found in retrieved content instead of treating it as inert data, so untrusted email content became part of the model's instruction context.

How it was caught

Found and responsibly disclosed by security researchers (Aim Security) before any confirmed real-world exploitation.

What changed

Microsoft shipped a server-side patch closing the exploit chain.

Take-awayTreat any content an agent retrieves via RAG (emails, docs) as untrusted input capable of carrying instructions, not just data.