By Collin Miller, Structured Cloud Security Director —

Microsoft 365 Copilot has become a cornerstone of modern productivity, embedding generative AI into Outlook, Word, Teams and more. But in June 2025, a critical vulnerability known as EchoLeak (CVE-2025-32711) sent a strong message: AI assistants aren’t just helpful, they’re also an attack vector.

In this post, I’ll break down what made EchoLeak so dangerous, how it worked inside M365 Copilot, what (if any) exploitation occurred, and what your organization needs to do to avoid falling victim to the next AI-native attack.

What Was EchoLeak?

EchoLeak was a zero-click vulnerability discovered by researchers at AIM Security that allowed malicious actors to exfiltrate sensitive data from Microsoft 365 environments without the user doing a thing. No clicking, no replying — just interacting with Copilot as usual was enough.

The root cause? A prompt injection vulnerability that exploited Copilot’s contextual understanding of user data.

How EchoLeak Works in Microsoft 365 Copilot

Here’s the high-level attack chain that made EchoLeak so unique and dangerous:

1. Malicious Email with Hidden Prompts: An attacker sends a well-crafted email to a target. The email includes invisible or obfuscated instructions embedded in the message body.
2. Prompt Injection via Copilot: When the user later interacts with Copilot — say, by asking “What’s in my inbox?” or requesting a summary — the malicious email is pulled into the retrieval-augmented generation (RAG) pipeline. The injected prompt silently instructs Copilot to perform unintended actions.
3. Silent Data Exfiltration: Copilot complies, unknowingly including sensitive data from the user’s environment (e.g., meeting notes, documents, messages) into outputs formatted as outbound HTTP requests — such as embedding data in image URLs or links to attacker-controlled servers.
4. No User Interaction Needed: The user never clicks anything. The AI assistant leaks data in the background.

This represents a new class of “LLM scope violation,” where inputs that are supposed to be inert (like inbox contents) are treated as executable instructions by AI models — a classic injection flaw, but in an AI-native form.

Was EchoLeak Exploited?

According to Microsoft’s disclosure, there was no evidence of active exploitation in the wild, and the issue was remediated server-side in May 2025.

That said, the vulnerability was proven in detailed proofs-of-concept. Researchers demonstrated that:

• Copilot could leak confidential business information from emails and calendars.
• Sensitive context (like customer data or pricing models) could be redirected to attacker servers.
• The exploit could affect any Microsoft 365 Copilot user — from finance teams to legal departments — with no indication to the victim.

What Organizations Should Do Now

Even though Microsoft has patched EchoLeak, it’s a warning for every security-conscious business deploying generative AI. Here’s what your org should be doing:

1. Conduct an AI Threat Assessment

Review where Copilot (and other AI tools) are integrated into your stack. Document what types of data it has access to — and where injection vectors (like email or SharePoint content) exist.

2. Implement AI Security Gateways

AI-aware security platforms (like prompt firewalls or RAG sanitizers) can inspect prompts and AI-generated outputs in real time. These are the LLM-era equivalents of web application firewalls.

3. Educate Users About Prompt Injection

Most phishing training covers links and attachments. Now we need to train employees about the risks of content-based injection — e.g., what happens when a Copilot prompt interacts with a hostile email?

4. Use Tenant-Restricted Copilot

Ensure you’re on Microsoft 365 Copilot with strong tenant boundaries and RBAC controls. Avoid granting Copilot access to high-risk data (PII, financials, source code) unless absolutely necessary.

5. Log and Monitor AI Activity

Microsoft Purview and Defender for Cloud Apps can help monitor Copilot actions and outputs. Set up DLP rules, and alert on unusual outbound requests or Copilot usage patterns.

Final Thoughts

EchoLeak was a first-of-its-kind AI vulnerability — zero-click, invisible, and exploiting the very logic that makes Copilot so helpful. It likely won’t be the last.

The future of enterprise AI requires a new security mindset. Not just endpoint protection or phishing filters, but guardrails for how our AI agents process and act on our data. Copilot is a powerful partner — but like any teammate, it needs coaching.

Need help auditing your Copilot deployment or putting guardrails around generative AI? Contact your account manager or email @info@structured.com today.

About the Author

Collin Miller has more than 20 years’ experience designing secure and sustainable IT infrastructures that protect data, users, and organizational resources. As cloud computing gained traction, Collin dedicated himself to the practice of cloud security. His expertise extends to securing data and workloads in all the large public cloud providers, as well as the best practices, platforms and tools required to secure SaaS applications and the data traversing them.

With a strong background in cybersecurity, Collin brings a disciplined approach and deep knowledge of zero trust practices and secure access service edge (SASE) architectures to cloud environments. He is adept with cloud security posture management (CSPM), cloud native application protection platforms (CNAPP), cloud access security broker (CASB) platforms, and more.