Zero-click bug revealed in Microsoft 365 Copilot

A new attack dubbed “EchoLeak” is the first known zero-click flaw related to Artificial Intelligence (AI) and allows attackers to extract sensitive data from Microsoft 365 Copilot through the user interface , without any interaction

See also: What are zero-click attacks – how to avoid them

The attack was designed by researchers at Aim Labs in January 2025 and reported to Microsoft. The tech company assigned the vulnerability the CVE-2025-32711, rated it critical , and patched the server-side issue in May, with no action required from users. Microsoft also said there was no evidence of actual exploitation of the vulnerability, so no customers were affected.

Microsoft 365 Copilot is an AI assistant built into Office apps like Word, Excel, Outlook, and Teams. It uses GPT models and the Microsoft Graph to help users create content, analyze data, and answer questions based on their organization's internal files, emails, and conversations.

Although the vulnerability was patched and not exploited maliciously, EchoLeak is significant as it highlights a new class of vulnerabilities, known as “LLM Scope Violation”, where a large language model (LLM) can leak privileged internal data without user intent or action.

Since the attack does not require interaction with the victim, it can be automated to silently extract data in enterprise environments, which highlights how dangerous such vulnerabilities can be in systems that incorporate artificial intelligence.

See also: Apple's 'AirBorne' flaws lead to zero-click AirPlay attacks

The attack begins by sending a malicious email to the target, which contains text unrelated to Copilot and is formatted to look like a typical business document.

Embedded within the email is a hidden prompt injection, specifically designed to trick the large language model (LLM) into extracting and sending sensitive internal data. Because the prompt is worded in a way that resembles a normal human message, it bypasses protection systems , specifically the XPIA (cross-prompt injection attack) detector.

Later, when the user asks Copilot a relevant business question, the email is automatically retrieved into LLM’s prompts via the Retrieval-Augmented Generation (RAG), due to its formatting and apparent relevance. The malicious prompt, now reaching LLM, tricks into extracting sensitive internal data and embedding it in an artificial link or image.

EchoLeak may have been patched, but the increasing complexity and deeper integration of LLM applications into business workflows is already outpacing traditional defenses. This same trend is sure to lead to the emergence of new, exploitable vulnerabilities that malicious actors can silently exploit to launch serious, high-impact attacks.

See also: Zero-Click vulnerability in macOS Calendar allows malicious actions

As large language models (LLMs), such as those built into Microsoft 365 Copilot, become central tools in business planning, the attack surface that cybercriminals. Prompt injection attacks, such as in EchoLeak, are an example of how AI can be manipulated without direct user interaction.

Source: bleepingcomputer