Agent Safety

An email that nobody opened was enough to take a secret out of Microsoft 365 Copilot. The researchers at Aim Labs who reported the flaw in January 2025 called it EchoLeak, and Microsoft published it on 11 June 2025 as CVE-2025-32711, an information-disclosure flaw rated 9.3 out of 10, critical, with no privileges and no user interaction required. The attack began with an ordinary-looking email, and nobody had to click anything. Later, when the recipient asked Copilot a routine question, Copilot's retrieval pulled the email into its context. The email's instructions, phrased as if addressed to the human recipient so that Microsoft's prompt-injection classifiers let it through, told the model to take the most sensitive information it could see and write it into a Markdown image reference. The user's browser tried to load the image from a Microsoft Teams address that the page's security policy trusted and that redirected to the attacker. The secret left in the URL.