EchoLeak: First AI Zero-Click Vulnerability Leaks Data from Microsoft 365 Copilot

In the age of artificial intelligence, a multitude of AI agents has emerged, yet their rapid proliferation has unveiled profound security vulnerabilities. Malicious actors are increasingly exploiting logical flaws within these AI models to orchestrate remote data exfiltration attacks.

Microsoft 365 Copilot, an AI-powered assistant integrated into Microsoft 365 applications, exemplifies this evolving landscape. In enterprise deployments, Microsoft 365 Copilot often leverages Retrieval-Augmented Generation (RAG) to semantically query content across users.

Organizations can configure Copilot to access internal data, enabling employees to receive highly relevant, accurate, and reliable AI-generated responses—thereby significantly enhancing productivity.

This enterprise-grade implementation allows Copilot to query Microsoft Graph and draw from a vast internal knowledge base, including emails, OneDrive files, Office documents, SharePoint sites, and Microsoft Teams conversations.

In January 2025, cybersecurity firm AIM identified a critical vulnerability within Microsoft’s AI ecosystem and responsibly disclosed it to the company. While Microsoft acknowledged the issue, the patching process was protracted, as additional related flaws were discovered during the remediation phase.

The vulnerability was named “LLM Scope Violation,” a term denoting an attack in which an adversary submits carefully crafted, untrusted inputs that manipulate the large language model into processing trusted contextual data—without the user’s explicit consent.

In a real-world example, researchers sent a seemingly innocuous email to an employee’s Microsoft Outlook inbox. The message contained no traditional phishing links and required no user interaction. Upon arrival, the AI agent automatically parsed the content, executed the embedded instructions, and transmitted harvested information back to the attacker—entirely autonomously.

Notably, the attack avoided conventional prompt engineering techniques. Instead, the malicious directives were phrased in a way that appeared intended for a human recipient, thereby circumventing Microsoft’s XPIA (Cross-Prompt Injection Attack) defense, which is designed to intercept prompt injection attempts targeting Copilot.

While this summary offers a simplified overview, the actual exploit chain is highly sophisticated and multifaceted. Interested readers are encouraged to consult AIM’s full technical report.

Following a comprehensive patch rollout, Microsoft issued a statement thanking AIM for its responsible disclosure and confirmed that all known vulnerabilities had been resolved. Remediation was deployed through automated systems, requiring no action from enterprise customers.

AIM has named this attack technique “EchoLeak.” While there is no evidence to date of real-world exploitation, the incident underscores a critical truth: as AI agents streamline enterprise workflows, they simultaneously introduce potent new vectors of risk.

Related Posts:

• New Attack on Microsoft 365 Copilot Steals Personal Data
• Mac Users Rejoice! Microsoft’s Copilot App Lands on the Mac App Store
• Copilot Phishing: New Scam Targets Microsoft Users
• Microsoft Unveils Enhanced Windows AI Features for “Copilot+ PC”
• Exploring the AI-Powered Windows Search Copilot+ PCs Feature