Test with real-world reachDate not established

EchoLeak demonstrates zero-click prompt injection against Copilot

Security researchers at Aim Security showed that a single crafted email could steer Microsoft 365 Copilot into disclosing information from a user's workspace, without the user clicking anything. Microsoft fixed the issue. The reviewed sources show no evidence it was used in real attacks.

Why it matters. A real-product example of how instructions hidden in ordinary content can hijack an AI assistant.

Independent investigationNot yet editor-reviewedUpdated 17 Oct 2026

Built by: Microsoft
Run by: Aim Security (Research demonstration)
System: Microsoft 365 Copilot
Affected: No outside party recorded
Real-world reach: Reported to have reached real systems
Setting · origin: Deployed product · Injected by an outside party

OccurredDate not established
First publicNot established
Time to first public accountNot established

What it was asked to do, and what it did

Expected	What it did
Help an employee with their own content, ignoring instructions from outside senders	Followed instructions in a crafted email toward disclosing data 001

Outcome. The discoverer reports coordinated disclosure and a fix; reviewed evidence does not establish malicious exploitation of customer tenants.

Timeline

Dates keep the precision the sources give.

2025; precise research dates unknownyear precision
Context · Researcher
Vulnerability research
Aim Labs investigated the Copilot interaction. 001
2025; before announcementyear precision
Response · Developer
Coordinated fix reported
Discoverer reports collaboration with Microsoft. 001
6 Sep 2025
Public account · Researcher
Later paper submitted
Independent case-study paper submitted to arXiv. 004

Claims & evidence

Discoverer’s public announcement; original long-form page blocked, MSRC page client-rendered, later technical study reviewed as a literature lead.

Backed by developer or operator account, independent investigation. No affected party or authority, raw transcripts, logs or code.

Basis for this claim

Aim Labs publicly reports a zero-click Copilot vulnerability and coordinated fix.

Aim Security: EchoLeak discovery announcement Operator · First-party announcement of the vulnerability and coordinated Microsoft fix.

What this does not establish

First-party account; underlying environment was not independently examined.

Consequences & response

Effects

Reported controlled demonstration of an unintended data-release capability.
No confirmed customer harm quantified here.

Response & proposed fixes

Discoverer reports a Microsoft fix.
Editorial recommendation: enforce data-origin and output-destination restrictions outside the model.

Reported, not independently tested.

Patterns

Behaviours: Indirect prompt injection Data exfiltration
Contributing conditions: Untrusted content in context
Impacts: Data accessed or exposed

What is not known

Limits of this account

Original detailed disclosure returned HTTP 403.
MSRC advisory details were not readable beyond its JavaScript shell.
Later technical-paper authors are not the original discovering team.
No victim count or in-the-wild exploitation established.

Open questions

Can the original detailed disclosure and vendor advisory be archived and reviewed?
What exact release and service-side fix scope applied?
What evidence supports exploitation status and customer-impact statements?

Sources

Reading a source is not the same as confirming everything in it.

001
Aim Security: EchoLeak discovery announcement
OperatorRead by researchersAccessed 17 Oct 2026
First-party announcement of the vulnerability and coordinated Microsoft fix.
002
Aim Labs EchoLeak detailed disclosure
OperatorCould not be accessedAccessed 17 Oct 2026
Canonical long-form source; access blocked during review.
003
Microsoft advisory CVE-2025-32711
DeveloperCould not be accessedAccessed 17 Oct 2026
Vendor advisory lead; substantive content unavailable in the JavaScript shell.
004
EchoLeak technical case-study paper
Independent researcherRead by researchersAccessed 17 Oct 2026
Later research analysis; useful attack-chain lead, not discoverer-authored forensic confirmation.

Cite & correct

misaligned.fyi. “EchoLeak demonstrates zero-click prompt injection against Copilot.” Case MF-038, record updated 17 Oct 2026. https://misaligned.fyi/cases/echoleak-copilot

Found an error or a missing source? Send a correction quoting MF-038. Corrections are logged on the updates page.

Loading the record…

Test with real-world reachDate not established

EchoLeak demonstrates zero-click prompt injection against Copilot

Why it matters. A real-product example of how instructions hidden in ordinary content can hijack an AI assistant.

Independent investigationNot yet editor-reviewedUpdated 17 Oct 2026

Built by: Microsoft
Run by: Aim Security (Research demonstration)
System: Microsoft 365 Copilot
Affected: No outside party recorded
Real-world reach: Reported to have reached real systems
Setting · origin: Deployed product · Injected by an outside party

OccurredDate not established
First publicNot established
Time to first public accountNot established

What it was asked to do, and what it did

Expected	What it did
Help an employee with their own content, ignoring instructions from outside senders	Followed instructions in a crafted email toward disclosing data 001

Outcome. The discoverer reports coordinated disclosure and a fix; reviewed evidence does not establish malicious exploitation of customer tenants.

Timeline

Dates keep the precision the sources give.

2025; precise research dates unknownyear precision
Context · Researcher
Vulnerability research
Aim Labs investigated the Copilot interaction. 001
2025; before announcementyear precision
Response · Developer
Coordinated fix reported
Discoverer reports collaboration with Microsoft. 001
6 Sep 2025
Public account · Researcher
Later paper submitted
Independent case-study paper submitted to arXiv. 004

Claims & evidence

Discoverer’s public announcement; original long-form page blocked, MSRC page client-rendered, later technical study reviewed as a literature lead.

Backed by developer or operator account, independent investigation. No affected party or authority, raw transcripts, logs or code.

Basis for this claim

Aim Labs publicly reports a zero-click Copilot vulnerability and coordinated fix.

Aim Security: EchoLeak discovery announcement Operator · First-party announcement of the vulnerability and coordinated Microsoft fix.

What this does not establish

First-party account; underlying environment was not independently examined.

Consequences & response

Effects

Reported controlled demonstration of an unintended data-release capability.
No confirmed customer harm quantified here.

Response & proposed fixes

Discoverer reports a Microsoft fix.
Editorial recommendation: enforce data-origin and output-destination restrictions outside the model.

Reported, not independently tested.

Patterns

Behaviours: Indirect prompt injection Data exfiltration
Contributing conditions: Untrusted content in context
Impacts: Data accessed or exposed

What is not known

Limits of this account

Original detailed disclosure returned HTTP 403.
MSRC advisory details were not readable beyond its JavaScript shell.
Later technical-paper authors are not the original discovering team.
No victim count or in-the-wild exploitation established.

Open questions

Can the original detailed disclosure and vendor advisory be archived and reviewed?
What exact release and service-side fix scope applied?
What evidence supports exploitation status and customer-impact statements?

Sources

Reading a source is not the same as confirming everything in it.

001
Aim Security: EchoLeak discovery announcement
OperatorRead by researchersAccessed 17 Oct 2026
First-party announcement of the vulnerability and coordinated Microsoft fix.
002
Aim Labs EchoLeak detailed disclosure
OperatorCould not be accessedAccessed 17 Oct 2026
Canonical long-form source; access blocked during review.
003
Microsoft advisory CVE-2025-32711
DeveloperCould not be accessedAccessed 17 Oct 2026
Vendor advisory lead; substantive content unavailable in the JavaScript shell.
004
EchoLeak technical case-study paper
Independent researcherRead by researchersAccessed 17 Oct 2026
Later research analysis; useful attack-chain lead, not discoverer-authored forensic confirmation.

Cite & correct

misaligned.fyi. “EchoLeak demonstrates zero-click prompt injection against Copilot.” Case MF-038, record updated 17 Oct 2026. https://misaligned.fyi/cases/echoleak-copilot

Found an error or a missing source? Send a correction quoting MF-038. Corrections are logged on the updates page.

What it was asked to do, and what it did

Timeline

Vulnerability research

Coordinated fix reported

Later paper submitted

Claims & evidence

Consequences & response

Effects

Response & proposed fixes

Patterns

What is not known

Limits of this account

Open questions

Sources

Cite & correct

See also

Researchers demonstrate self-replicating prompt injections

Retrieved content redirects LLM-integrated applications

What it was asked to do, and what it did

Timeline

Vulnerability research

Coordinated fix reported

Later paper submitted

Claims & evidence

Consequences & response

Effects

Response & proposed fixes

Patterns

What is not known

Limits of this account

Open questions

Sources

Cite & correct

See also

Researchers demonstrate self-replicating prompt injections

Retrieved content redirects LLM-integrated applications