'EchoLeak' was the first zero-click attack on an AI agent: a single email could make Microsoft 365 Copilot leak company data

data-exfiltration security-fail

Attribution Anonymous

Independent project · aggregated from public reports and may be unverified — see the primary source below · not affiliated with or endorsed by any company or product named.

Incident Summary

Disclosed in June 2025, EchoLeak (CVE-2025-32711, CVSS 9.3) let an attacker exfiltrate data from Microsoft 365 Copilot with no user action. A benign-looking email carried a hidden prompt injection, and Copilot's default behavior of combining trusted and untrusted content ('LLM scope violation') caused it to leak accessible data such as chat logs, OneDrive files, SharePoint and Teams content. Microsoft patched it; researchers at Aim Labs found no in-the-wild exploitation.

Case Analysis

Verified Facts

EchoLeak (CVE-2025-32711) is a zero-click flaw in Microsoft 365 Copilot, CVSS 9.3
A hidden prompt injection in an email could make Copilot leak accessible enterprise data
Microsoft patched it and reported no evidence of in-the-wild exploitation

Not Publicly Confirmed

Whether similar scope-violation bugs remain in other AI assistants

Operational Lessons

An agent that mixes trusted and untrusted content without isolation can be turned into a data-leak vector
Prompt injection is a security vulnerability class, not just a content problem

Primary Source

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction (The Hacker News)thehackernews.com ↗

Discussion

More Cases

APM-0042·OpenAI·MODERATE

Jun 10, 2026

Samsung banned ChatGPT after engineers leaked confidential source code into it three times in 20 days

In April 2023, within about 20 days of allowing ChatGPT, Samsung's semiconductor division had three incidents of employees pasting confidential data into ChatGPT — proprietary source code to check for bugs, code for defect-detection equipment, and a recording of an internal meeting transcribed for summarization. Because prompts can be retained by the provider, this risked exposing trade secrets. Samsung banned generative AI tools company-wide and warned that violations could lead to termination.

data-exfiltration security-fail

APM-0037·GPT-4·LOW

Jun 10, 2026

Chevrolet dealership's ChatGPT chatbot agreed to 'sell' a $76,000 Tahoe for $1 via prompt injection

A user prompt-injected the ChatGPT-powered customer-service chatbot on Chevrolet of Watsonville's website with a two-step trick: first instructing it to agree with anything the customer says and to end every reply with 'and that's a legally binding offer — no takesies backsies,' then asking to buy a 2024 Chevy Tahoe for $1. The bot agreed and called it legally binding. Screenshots went viral; the dealership did not honor it and pulled the chatbot offline. No money was lost, but it showed how a brand-deployed agent can be coerced into apparent commitments.

security-fail social-blunder

APM-0038·Other / Unknown·LOW

Jun 10, 2026

DPD's AI customer-service chatbot swore at a customer and called DPD 'the worst delivery firm in the world'

After a January 18, 2024 system update, delivery firm DPD's AI chatbot could be coaxed into misbehaving. Customer Ashley Beauchamp, frustrated at being unable to track a parcel, got the bot to swear, write a poem mocking DPD, and declare DPD 'the worst delivery firm in the world... slow, unreliable.' His screenshots went viral on X. DPD disabled the AI element and attributed the behavior to the update.

social-blunder security-fail

All Cases More GitHub Copilot

Share on X