On September 6, 2025, cybersecurity researchers published a landmark paper on arXiv documenting EchoLeak (CVE-2025-32711), the first confirmed zero-click prompt injection exploit targeting a production large language model system. The vulnerability in Microsoft 365 Copilot carries a CVSS score of 9.3 and demonstrates how AI-powered enterprise tools can become vectors for silent data exfiltration, raising urgent questions for every organization deploying AI assistants alongside sensitive business data.
The Exploit Mechanics
Discovered by Aim Labs, the research division of Aim Security, EchoLeak exploits the fundamental architecture of Retrieval-Augmented Generation (RAG) systems that power Microsoft 365 Copilot. The attack chain operates through a multi-stage process that requires no user interaction whatsoever.
The attacker begins by sending a carefully crafted email to the target’s Outlook inbox. This email contains hidden prompt injection instructions disguised as ordinary business text, specifically engineered to evade Microsoft’s cross-prompt injection attack (XPIA) classifiers. The message never explicitly references Copilot or AI, making it invisible to standard security filters.
When the target user later asks Copilot a routine business question—such as “summarize our quarterly report”—Copilot’s RAG engine searches the user’s data environment for relevant information. During this retrieval process, the malicious email gets pulled into Copilot’s context window alongside legitimate business documents.
Once the LLM processes the query with the injected context, the attacker’s hidden instructions execute. The prompt instructs Copilot to extract the most sensitive information available in its current context and encode it into an image URL pointing to an attacker-controlled server. Because the Copilot chat client runs in the user’s browser, it automatically attempts to load this image, silently transmitting the stolen data via URL query parameters.
Affected Systems
The vulnerability affects Microsoft 365 Copilot across its entire integration surface. Copilot’s RAG architecture connects to Outlook emails, OneDrive files, SharePoint documents, Teams chats, and other M365 services. Each of these data sources becomes a potential attack vector when a malicious prompt injection is present.
At the time of Bitcoin trading near $110,224 and Ethereum at $4,274, the cryptocurrency industry faces particular exposure. Crypto exchanges, trading firms, and blockchain companies widely use Microsoft 365 for business operations. A compromised Copilot instance in a crypto trading firm could potentially expose wallet addresses, private keys stored in documents, trading strategies, or internal communications about token launches.
The vulnerability also intersects with Web3 development workflows where AI-assisted coding tools increasingly access codebases containing smart contract logic and deployment configurations. A successful EchoLeak-style attack could exfiltrate unpublished contract addresses or audit reports before public disclosure.
The Mitigation Strategy
Microsoft patched CVE-2025-32711 in June 2025 before the public disclosure, and no evidence of in-the-wild exploitation was found. However, the mitigation approach reveals broader challenges in securing AI-integrated enterprise systems.
Organizations should implement strict data access boundaries for AI assistants, limiting which data sources Copilot can retrieve during any single query. Network-level monitoring for unusual outbound connections from browser sessions running Copilot can detect the image-based exfiltration technique. Security teams should also deploy dedicated AI prompt sanitization layers that inspect retrieved context before it reaches the LLM.
For cryptocurrency businesses specifically, this means ensuring that AI assistants never have simultaneous access to both external communications (email) and sensitive internal documents (wallet configurations, key management procedures). Segregating these data domains reduces the attack surface significantly.
Lessons Learned
EchoLeak demonstrates that traditional security boundaries dissolve when AI assistants bridge previously isolated data sources. The vulnerability operates entirely in natural language space—there is no code to detect, no malware signature to match, and no suspicious file to quarantine. The payload is plain text embedded in a legitimate business email.
The research also highlights a fundamental tension in AI-powered productivity tools: the more data an AI assistant can access to provide helpful responses, the more valuable a target it becomes for attackers. Every additional data integration point—email, documents, chat, calendar—expands the potential blast radius of a successful prompt injection.
Security teams must rethink their threat models to account for AI-mediated data flows. Perimeter defenses and endpoint protection are necessary but insufficient when the attack vector is a well-crafted sentence in an email that an AI assistant helpfully reads and acts upon.
User Action Required
Verify that your Microsoft 365 tenant has received the June 2025 security updates that address CVE-2025-32711. Review Copilot’s data access permissions and restrict retrieval to only necessary data sources. Implement network monitoring for anomalous outbound requests from browser sessions. Train employees that AI assistants process all accessible data, including emails from unknown senders, making email hygiene more critical than ever. For crypto organizations, ensure AI tools cannot access both external communications and sensitive internal systems simultaneously.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
CVSS 9.3 on a zero-click AI exploit is terrifying. the attack surface of LLM-powered tools is massively underestimated in enterprise settings
prompt_inject CVSS 9.3 on a zero-click is enterprise security’s nightmare. every company using M365 Copilot just became attack surface
CVSS 9.3 and all it took was sending an email. the RAG pipeline basically reads attacker instructions as if theyre user commands
the scariest part is the email looked like normal business text. no mention of Copilot or AI anywhere. XPIA classifiers had nothing to flag
CVSS 9.3 from sending an email. the RAG layer literally cannot distinguish between user input and retrieved documents
zero-click means the user literally did nothing wrong and still got owned. at least with phishing you can train people. RAG injection has no human defense
RAG treating retrieved content as trusted input is a fundamental architecture flaw. you cant patch this with better classifiers. the LLM literally cannot tell the difference between user instructions and document content
copilot_disable_ RAG treating retrieved content as trusted is a design flaw not a bug. you cant classifier your way out of a fundamental architecture problem
Bug bounties are the most cost-effective security investment
The cost of a security breach always exceeds the cost of prevention
Real-time monitoring tools are getting better at catching exploits early
Social engineering attacks are becoming more sophisticated
Olga social engineering via AI prompt injection is a new category of threat. traditional security training does not cover this at all
my org disabled Copilot for two weeks after this dropped. security teams had zero detection playbook for prompt injection
disabling copilot for 2 weeks was the right call. most orgs have zero detection for prompt injection, its a brand new attack surface
Anneliese W. 2 weeks is nothing. we disabled copilot permanently after echoleak. the cross prompt injection attack surface is unfixable with current RAG architecture
xpia_skeptic_ permanent disable is the only rational call. the RAG layer treating retrieved content as trusted input is a design flaw not a bug you patch
Formal verification should be mandatory for high-value protocols
mandatory formal verification would kill smaller protocols though. cost has to come down before it can be a requirement
CVSS 9.3 from a single email with zero user interaction. every CISO who deployed copilot without a prompt injection threat model should be updating their resume
CVSS 9.3 and microsofts response was basically disable copilot and hope. every fortune 500 running M365 became attack surface overnight
Marcus D. every Fortune 500 running M365 became attack surface from a single email. the blast radius of this CVE exceeds any traditional software vuln because it targets trust pathways
every fortune 500 running M365 became attack surface overnight. the blast radius of this CVE is larger than any traditional software vulnerability because it targets human trust pathways not code
the email contained hidden prompt injection that never mentioned Copilot or AI. XPIA classifiers had literally nothing to pattern match against. this was a zero-day in the truest sense
Weronika P. zero-click means the user did literally nothing. at least phishing requires a click. RAG injection has no human defense layer