Access
EchoLeak: one email was enough to make Copilot hand over data
In June 2025 Aim Security showed how an email carrying hidden instructions could make Microsoft 365 Copilot send a user's sensitive data to an outside server, without a single click.
Microsoft 365 Copilot is the AI assistant in Word, PowerPoint, Outlook and other Microsoft apps: to answer, it draws on the user's emails, files and chats. In January 2025 researchers at the security company Aim Security devised an attack on it that needed nothing from the victim, and reported it to Microsoft. The flaw, named EchoLeak, was made public on 11 June 2025.
The attacker sent an email that looked like an ordinary business message but contained hidden instructions. They were worded as if addressed to the human recipient, so Microsoft's filter for this kind of attack did not recognise them. The recipient did not even have to open the email. When they later asked Copilot about a related topic, such as leave management, Copilot retrieved the email too and followed its instructions: it placed sensitive data from its context into a link or an image. When the image loaded, the browser automatically sent the data to the attacker's server. Microsoft's safeguards blocked most outside addresses but treated its own Teams and SharePoint addresses as trusted, and the data got out through those.
Microsoft rated the flaw (CVE-2025-32711) critical and fixed it on its own servers in May 2025, so users had nothing to do. The company said there was no sign of it being exploited in a real attack. Aim said the technique might work against other AI applications as well.
What can we learn from it?
An assistant that can reach our emails and files and also reads text from outside may take a stranger's email as an instruction. Assistants are useful, and what they can reach is mostly up to us. In Confiella the model has no access to email, files or the web: it only receives the request the user has reviewed and approved. With other tools, go through what they can reach and allow only what the task really needs; client correspondence and session notes only when the task truly calls for them.
Sources
- SecurityWeek: 'EchoLeak' AI Attack Enabled Theft of Sensitive Data via Microsoft 365 Copilot
- BleepingComputer: Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]