id: PIR-2026-0017title: Zero-click indirect prompt injection in Microsoft 365 Copilot enables silent exfiltration of enterprise data from a single email (CVE-2025-32711, "EchoLeak")date_occurred: not applicable - vulnerability window; PoC working Jan 2025, server-side fix ~May 2025date_detected: 2025-01 (reported to Microsoft MSRC by Aim Labs / Aim Security)date_disclosed: 2025-06-11 (Aim Labs public writeup; CVE-2025-32711 assigned)status: corroborated (vendor CVE + researcher writeup + independent coverage + arXiv)agent_description: Microsoft 365 Copilot - enterprise RAG assistant over Outlook, Word, Excel, PowerPoint, Teams and SharePoint; assembles user data into model context to answer questions.operator_type: enterprise (Microsoft-operated SaaS, deployed inside customer tenants)autonomy_level: human-on-the-loop (user prompts Copilot; the injected read/exfil step runs with no human gate on the retrieval and link-fetch)model_stack: Microsoft 365 Copilot (OpenAI models via Microsoft, versions not disclosed)harness: Microsoft's Copilot RAG orchestration; XPIA prompt-injection classifier; CSP allow-list including a Teams proxyauthority_scope: data access (all tenant content in Copilot's retrieval scope), external comms (auto-fetched image/link URLs)funds_at_risk_usd: unknown (data-confidentiality incident, not a funds-moving agent)blast_radius: customers/third parties (any M365 Copilot tenant, until server-side patch)failure_locus: harness (Copilot's RAG context-assembly, classifier bypass, and CSP/link handling - not the model's reasoning per se)root_cause: prompt-injection (primary; indirect, via untrusted email content)mechanism: A benign-looking email carries hidden instructions (HTML comment / white-on-white text) that evade Microsoft's XPIA classifier. When the user later asks Copilot an unrelated question, RAG pulls the malicious email into context; the injected instructions coerce Copilot to gather internal data and encode it into a reference-style markdown image/link; auto-fetched URLs via a CSP-allowed Teams proxy exfiltrate the data with zero user clicks. Described by researchers as the first "LLM Scope Violation" chain in a production system.adversary_present: yes (external attacker crafts the email; here, security researchers)exploitation_status: researcher-demonstrated (Aim Labs against production M365 Copilot; no in-wild exploitation per Microsoft)severity: near-miss (full exfiltration primitive proven against production; no realized third-party loss)direct_loss_usd: 0indirect_loss_usd: unknown (vendor remediation cost; no customer loss attributed)downtime: none reported (fixed server-side, no customer action required)data_exposure: none realized; capability was full tenant-scope data reachable by Copilot's retrievaldetected_by: third-party (Aim Labs security researchers)time_to_detect: not applicable (proactive research finding)time_to_recover: ~months from report (Jan 2025) to server-side fix (~May 2025)remediation: Microsoft patched server-side; assigned CVE-2025-32711 (CVSS 9.3); no customer action requiredstructural_fix: server-side mitigations to the classifier-bypass and link-exfiltration paths (Microsoft-side; specifics not fully published)controls_that_worked: partial - the XPIA classifier and link redaction existed but were each bypassed; the chain succeeded by defeating all layers, so no single control bounded it. Post-patch server-side controls are the functioning boundary.telemetry_grade: none/vendor-attested - "no in-wild exploitation" rests on Microsoft's attestation; the research chain is reproducibly documented but no independent production-telemetry confirms non-exploitation.sources:Independence: strong - independent security firms + arXiv + trade press corroborate the researcher account; the "no exploitation" claim is single-source (Microsoft).
- confidence: high on mechanism, dates, and CVE (multiple independent sources agree); medium on the no-in-wild-exploitation claim (vendor attestation only)
researcher-demonstrated exploitation_status correctly separates this from in-wild loss.