A zero-click email exfiltrated Microsoft 365 Copilot data without user interaction
Researchers disclosed CVE-2025-32711 (EchoLeak): a malicious email could bypass Copilot's prompt-injection classifier, link redaction, and content-security policy to silently exfiltrate enterprise data.
Indirect prompt injection does not need a user. The retrieval surface IS the user.
Key facts
- What
- Researchers disclosed CVE-2025-32711 (EchoLeak): a malicious email could bypass Copilot's prompt-injection classifier, link redaction, and content-security policy to silently exfiltrate enterprise data.
- Incident date
- Jun 11, 2025
- Who
- Microsoft
- Failure mode
- Prompt Injection
- AI surface
- Copilot
- Severity
- Catastrophic
What happened
In June 2025, Aim Labs disclosed CVE-2025-32711, a critical vulnerability they called EchoLeak in Microsoft 365 Copilot. A single email containing crafted instructions could bypass Copilot's prompt-injection classifier, link redaction, content-security-policy, and reference-mention rules to silently exfiltrate enterprise data. No user interaction was required. Microsoft patched server-side.
The case is the most cited example of indirect prompt injection at enterprise scale. It is also the clearest illustration of why prompt-injection defenses applied as a classifier are not sufficient: a single email that the classifier rates as safe can still carry an injection payload through retrieval into the model.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
Indirect prompt injection. The email was treated as content for retrieval. The model read the email's instructions and treated them as authoritative. The classifier did not catch the injection because the injection looked like an ordinary email. The defense in depth did not depth deep enough.
What it cost
Sources
- PrimaryCVE-2025-32711: Microsoft 365 Copilot Information Disclosuremsrc.microsoft.com
- PrimaryAim Labs EchoLeak research disclosureaim.security
Cite this entry
https://failureindex.ai/failures/microsoft-copilot-echoleak-zero-clickAI Failure Index. "A zero-click email exfiltrated Microsoft 365 Copilot data without user interaction" (FI-0018). Realm Labs. https://failureindex.ai/failures/microsoft-copilot-echoleak-zero-click (indexed May 13, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0018. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Prism reads the model's representation when it starts following retrieved instructions. When the model commits to an action sourced from a low-trust retrieval surface, Prism flags it and OmniGuard either strips the instruction, requires user confirmation, or refuses the tool call. The exfiltration does not happen.