Incident·WS-0040·Jun 11, 2025·in the wild·AI security flaws

EchoLeak: zero-click data theft via Microsoft 365 Copilot

Microsoft / 365 Copilot; Aim Security (researchers)

39/100

WS-2 Moderate

Harm score 20, signal score 62. Autonomy: acted (the AI took a bounded action). How the scores work.

Harm 0/5

damage actually done

Reach 4/5

who was affected

Autonomy 2/4

how much the AI did on its own

Novelty 4/5

how new the behavior was

Permanence 0/5

how hard it is to undo

Aim Security showed that a crafted email could inject instructions that Copilot later retrieved while answering an unrelated user question, causing it to leak internal data to an attacker via Teams/SharePoint URLs without any user click. Microsoft fixed it service-side as CVE-2025-32711.

Damage

none realized (no evidence of exploitation); CVSS 9.3

Sources

The Hacker News, second source. Described as first zero-click prompt-injection exploit against a production LLM assistant.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.