# PIR-2026-0017 - EchoLeak: zero-click prompt-injection data exfiltration in Microsoft 365 Copilot (CVE-2025-32711)

- `id`: PIR-2026-0017
- `title`: Zero-click indirect prompt injection in Microsoft 365 Copilot enables silent exfiltration of enterprise data from a single email (CVE-2025-32711, "EchoLeak")
- `date_occurred`: not applicable - vulnerability window; PoC working Jan 2025, server-side fix ~May 2025
- `date_detected`: 2025-01 (reported to Microsoft MSRC by Aim Labs / Aim Security)
- `date_disclosed`: 2025-06-11 (Aim Labs public writeup; CVE-2025-32711 assigned)
- `status`: corroborated (vendor CVE + researcher writeup + independent coverage + arXiv)

### The agent
- `agent_description`: Microsoft 365 Copilot - enterprise RAG assistant over Outlook, Word, Excel, PowerPoint, Teams and SharePoint; assembles user data into model context to answer questions.
- `operator_type`: enterprise (Microsoft-operated SaaS, deployed inside customer tenants)
- `autonomy_level`: human-on-the-loop (user prompts Copilot; the injected read/exfil step runs with no human gate on the retrieval and link-fetch)
- `model_stack`: Microsoft 365 Copilot (OpenAI models via Microsoft, versions not disclosed)
- `harness`: Microsoft's Copilot RAG orchestration; XPIA prompt-injection classifier; CSP allow-list including a Teams proxy

### Authority
- `authority_scope`: data access (all tenant content in Copilot's retrieval scope), external comms (auto-fetched image/link URLs)
- `funds_at_risk_usd`: unknown (data-confidentiality incident, not a funds-moving agent)
- `blast_radius`: customers/third parties (any M365 Copilot tenant, until server-side patch)
- `failure_locus`: harness (Copilot's RAG context-assembly, classifier bypass, and CSP/link handling - not the model's reasoning per se)

### The failure
- `root_cause`: prompt-injection (primary; indirect, via untrusted email content)
- `mechanism`: A benign-looking email carries hidden instructions (HTML comment / white-on-white text) that evade Microsoft's XPIA classifier. When the user later asks Copilot an unrelated question, RAG pulls the malicious email into context; the injected instructions coerce Copilot to gather internal data and encode it into a reference-style markdown image/link; auto-fetched URLs via a CSP-allowed Teams proxy exfiltrate the data with zero user clicks. Described by researchers as the first "LLM Scope Violation" chain in a production system.
- `adversary_present`: yes (external attacker crafts the email; here, security researchers)
- `exploitation_status`: researcher-demonstrated (Aim Labs against production M365 Copilot; no in-wild exploitation per Microsoft)

### Impact
- `severity`: near-miss (full exfiltration primitive proven against production; no realized third-party loss)
- `direct_loss_usd`: 0
- `indirect_loss_usd`: unknown (vendor remediation cost; no customer loss attributed)
- `downtime`: none reported (fixed server-side, no customer action required)
- `data_exposure`: none realized; capability was full tenant-scope data reachable by Copilot's retrieval

### Detection and recovery
- `detected_by`: third-party (Aim Labs security researchers)
- `time_to_detect`: not applicable (proactive research finding)
- `time_to_recover`: ~months from report (Jan 2025) to server-side fix (~May 2025)
- `remediation`: Microsoft patched server-side; assigned CVE-2025-32711 (CVSS 9.3); no customer action required
- `structural_fix`: server-side mitigations to the classifier-bypass and link-exfiltration paths (Microsoft-side; specifics not fully published)
- `controls_that_worked`: partial - the XPIA classifier and link redaction existed but were each bypassed; the chain succeeded by defeating all layers, so no single control bounded it. Post-patch server-side controls are the functioning boundary.

### Evidence
- `telemetry_grade`: none/vendor-attested - "no in-wild exploitation" rests on Microsoft's attestation; the research chain is reproducibly documented but no independent production-telemetry confirms non-exploitation.
- `sources`:
  - https://www.hackthebox.com/blog/cve-2025-32711-echoleak-copilot-vulnerability
  - https://arxiv.org/abs/2509.10540
  - https://sentra.io/blog/copilot-echoleak-prompt-injection
  - https://socprime.com/blog/cve-2025-32711-zero-click-ai-vulnerability/
  - https://www.securityweek.com/echoleak-ai-attack-enabled-theft-of-sensitive-data-via-microsoft-365-copilot/
  - `independence`: strong - independent security firms + arXiv + trade press corroborate the researcher account; the "no exploitation" claim is single-source (Microsoft).
- `confidence`: high on mechanism, dates, and CVE (multiple independent sources agree); medium on the no-in-wild-exploitation claim (vendor attestation only)

### Verification notes
- CVSS score (9.3) confirmed via SOC Prime and Checkmarx; candidate intake did not carry the score - added.
- Timeline confirmed: reported Jan 2025, server-side fix ~May 2025, public disclosure 2025-06-11. Candidate's "patched server-side by June 2025" is consistent (fix landed before the June disclosure).
- Classification holds under v0.1: near-miss + `researcher-demonstrated` exploitation_status correctly separates this from in-wild loss.