mythsthe AIEchoLeak / Microsoft 365 Copilot2025enterprise productivity / ai

everyone assumed:

for an attacker to reach our data, someone here has to click something

what was actually true:

An AI assistant inherits every permission its user holds, and it reads what arrives without judging who sent it.

how it happened

  1. whocrafted emailnever opened by anyone
  2. the targetCopilottakes instructions from content
  3. thenuser's reachmail, drives, chats
  4. how it stoppedpatchedfound by researchers first
where it was aimed where it stopped

what everyone assumed

Decades of security training compress into a single rule: the danger lives in the click. Phishing programs, awareness posters, simulated lures, all of it teaches people to withhold one action, because an attack was understood to need a human to do something. AI assistants seemed to inherit the rule. The assistant only acts when a person asks it to, so the person still looked like the gate.

what happened

Here the quiet months are hypothetical, and that is worth saying plainly: no exploitation of this flaw in the wild is known. What existed was the mechanism, live in a production assistant deployed across organizations. EchoLeak, tracked as CVE-2025-32711, was a zero-click prompt injection in Microsoft 365 Copilot. A crafted message could carry instructions the assistant would ingest while building an answer, and those instructions could steer it into sending out data the user’s permissions could reach. The reach was whatever years of quiet oversharing had left open to each mailbox, drive, and chat the assistant could read.

step by step

  1. Copilot reads mail, files and chats for the userIts reach is whatever years of oversharing left open.
  2. a crafted message carries hidden instructionsThe assistant ingests them while building an answer, with no click needed.the assumption breaks here
  3. the instructions can steer data outAnything the user's permissions reach could be sent.
  4. June 2025Aim Security discloses, Microsoft patchesCVE-2025-32711. No exploitation in the wild is known.

how it surfaced

Researchers at Aim Security found the flaw and disclosed it in June 2025. Microsoft patched it. The window closed before any known attacker walked through it, which makes this a rare incident file: the lesson arrived without the casualty. The shape it revealed stands regardless. An assistant that reads on your behalf can be given instructions by anyone able to place content where it reads.

An AI assistant inherits every permission its user holds, and it reads what arrives without judging who sent it.

That combination turns crafted content into a command channel and turns oversharing into an exfiltration path. The click, the one action all the training guards, has left the loop.

picture it at a company like yours

The company here is made up. The other two paths are not: they happened, and each links to the story.

your company
a normal dayYou switch on an AI assistant that can read everyone's email and files to answer questions.
the gap nobody seesIt reads whatever lands in an inbox, including instructions hidden inside an email.an AI that acts on whatever it reads
  1. in this story
    the day it mattersA stranger sends an email with hidden instructions telling the assistant to send data out.
    what it costs youThe assistant could pass along anything your staff can see, without anyone clicking a thing.
  2. or it goes like this
    howA tool description tells the agent to send files somewhere else.
    what leavesfiles the agent can openwho ends up with itwhoever wrote the tool
    it happenedMCP tool poisoning, 2025
  3. or it goes like this
    howAn agent with production access ignores the instruction to change nothing.
    what leavesthe live database, deletedwho ends up with ityour customers, who notice first
    it happenedReplit agent database deletion, 2025

sources

  1. EchoLeak: the first real-world zero-click prompt injection exploit in a production LLM system (arXiv)
  2. TechRepublic: first known zero-click AI exploit, Microsoft 365 Copilot EchoLeak

← all myths

your turn

what you can do about it

  1. this week

    Pick one heavy Copilot user and list what their account can actually read across mail, drives, and chats.

    If an assistant in your stack can read incoming mail or shared documents and can also reach sensitive files, the EchoLeak shape is present in your environment today, patch or no patch. That list is what a message written for the assistant, rather than for the human, could have reached. Patching closed one flaw; the durable control is shrinking what each identity can see.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.