Security researchers at Aim Security have disclosed EchoLeak (CVE-2025-32711), the first confirmed zero-click prompt injection vulnerability that enables automated data exfiltration from Microsoft 365 Copilot — without requiring any user interaction beyond normal Copilot usage.
How EchoLeak Works
EchoLeak exploits fundamental design patterns common to RAG-based AI copilots. The attack chain combines three distinct vulnerabilities: a prompt injection delivery mechanism through poisoned documents stored in SharePoint or OneDrive, a safety-filter bypass using sophisticated Unicode character substitutions and prompt obfuscation, and an exfiltration channel that forces Copilot to embed sensitive data within outbound HTTP requests disguised as rendered Markdown elements.
In practice, an attacker places a crafted document in a shared workspace — for example, a seemingly innocuous meeting agenda or project brief. When any user in the organization queries Copilot and the poisoned document enters the retrieval context, the hidden instructions activate. Copilot then silently extracts sensitive business data from the user's accessible files and transmits it to an attacker-controlled URL — all within a single Copilot interaction and completely invisible to the victim.
Bypassing Safety Filters at the Semantic Layer
The researchers demonstrated that Microsoft's keyword-based content filters could be bypassed using Base64 encoding, hexadecimal representations, and Unicode homoglyph substitutions — characters that appear identical to human readers but carry different underlying digital signatures. This allowed malicious instructions to pass through safety layers while remaining fully interpretable by the LLM.
Impact and Remediation
The vulnerability affected any organization running Microsoft 365 Copilot with connected SharePoint or OneDrive data sources. Microsoft has acknowledged the disclosure and deployed mitigations. However, the broader implications are significant: EchoLeak demonstrates that indirect prompt injection in enterprise AI assistants is not theoretical but actively exploitable, and that traditional perimeter defenses are insufficient against attacks operating at the semantic layer.
Defenders should audit AI assistant data-source connections, implement strict document provenance controls, deploy output monitoring for anomalous HTTP requests within Copilot sessions, and test AI deployments against indirect prompt injection scenarios.