PIR-2026-0017 - EchoLeak: zero-click prompt-injection data exfiltration in Microsoft 365 Copilot (CVE-2025-32711)

id: PIR-2026-0017
title: Zero-click indirect prompt injection in Microsoft 365 Copilot enables silent exfiltration of enterprise data from a single email (CVE-2025-32711, "EchoLeak")
date_occurred: not applicable - vulnerability window; PoC working Jan 2025, server-side fix ~May 2025
date_detected: 2025-01 (reported to Microsoft MSRC by Aim Labs / Aim Security)
date_disclosed: 2025-06-11 (Aim Labs public writeup; CVE-2025-32711 assigned)
status: corroborated (vendor CVE + researcher writeup + independent coverage + arXiv)

agent_description: Microsoft 365 Copilot - enterprise RAG assistant over Outlook, Word, Excel, PowerPoint, Teams and SharePoint; assembles user data into model context to answer questions.
operator_type: enterprise (Microsoft-operated SaaS, deployed inside customer tenants)
autonomy_level: human-on-the-loop (user prompts Copilot; the injected read/exfil step runs with no human gate on the retrieval and link-fetch)
model_stack: Microsoft 365 Copilot (OpenAI models via Microsoft, versions not disclosed)
harness: Microsoft's Copilot RAG orchestration; XPIA prompt-injection classifier; CSP allow-list including a Teams proxy

authority_scope: data access (all tenant content in Copilot's retrieval scope), external comms (auto-fetched image/link URLs)
funds_at_risk_usd: unknown (data-confidentiality incident, not a funds-moving agent)
blast_radius: customers/third parties (any M365 Copilot tenant, until server-side patch)
failure_locus: harness (Copilot's RAG context-assembly, classifier bypass, and CSP/link handling - not the model's reasoning per se)

root_cause: prompt-injection (primary; indirect, via untrusted email content)
mechanism: A benign-looking email carries hidden instructions (HTML comment / white-on-white text) that evade Microsoft's XPIA classifier. When the user later asks Copilot an unrelated question, RAG pulls the malicious email into context; the injected instructions coerce Copilot to gather internal data and encode it into a reference-style markdown image/link; auto-fetched URLs via a CSP-allowed Teams proxy exfiltrate the data with zero user clicks. Described by researchers as the first "LLM Scope Violation" chain in a production system.
adversary_present: yes (external attacker crafts the email; here, security researchers)
exploitation_status: researcher-demonstrated (Aim Labs against production M365 Copilot; no in-wild exploitation per Microsoft)

severity: near-miss (full exfiltration primitive proven against production; no realized third-party loss)
direct_loss_usd: 0
indirect_loss_usd: unknown (vendor remediation cost; no customer loss attributed)
downtime: none reported (fixed server-side, no customer action required)
data_exposure: none realized; capability was full tenant-scope data reachable by Copilot's retrieval

detected_by: third-party (Aim Labs security researchers)
time_to_detect: not applicable (proactive research finding)
time_to_recover: ~months from report (Jan 2025) to server-side fix (~May 2025)
remediation: Microsoft patched server-side; assigned CVE-2025-32711 (CVSS 9.3); no customer action required
structural_fix: server-side mitigations to the classifier-bypass and link-exfiltration paths (Microsoft-side; specifics not fully published)
controls_that_worked: partial - the XPIA classifier and link redaction existed but were each bypassed; the chain succeeded by defeating all layers, so no single control bounded it. Post-patch server-side controls are the functioning boundary.

telemetry_grade: none/vendor-attested - "no in-wild exploitation" rests on Microsoft's attestation; the research chain is reproducibly documented but no independent production-telemetry confirms non-exploitation.
sources:
- https://www.hackthebox.com/blog/cve-2025-32711-echoleak-copilot-vulnerability
- https://arxiv.org/abs/2509.10540
- https://sentra.io/blog/copilot-echoleak-prompt-injection
- https://socprime.com/blog/cve-2025-32711-zero-click-ai-vulnerability/
- https://www.securityweek.com/echoleak-ai-attack-enabled-theft-of-sensitive-data-via-microsoft-365-copilot/
- independence: strong - independent security firms + arXiv + trade press corroborate the researcher account; the "no exploitation" claim is single-source (Microsoft).
confidence: high on mechanism, dates, and CVE (multiple independent sources agree); medium on the no-in-wild-exploitation claim (vendor attestation only)

CVSS score (9.3) confirmed via SOC Prime and Checkmarx; candidate intake did not carry the score - added.
Timeline confirmed: reported Jan 2025, server-side fix ~May 2025, public disclosure 2025-06-11. Candidate's "patched server-side by June 2025" is consistent (fix landed before the June disclosure).
Classification holds under v0.1: near-miss + researcher-demonstrated exploitation_status correctly separates this from in-wild loss.

EchoLeak: zero-click prompt-injection data exfiltration in Microsoft 365 Copilot…