EchoLeak: How a Single Email Turned Microsoft 365 Copilot Into an Exfiltration Tool
Key takeaways
- →Researchers showed that a crafted email could steer Microsoft 365 Copilot into leaking data from the user's context.
- →Every traditional control passed: the assistant used legitimate access through legitimate channels.
- →AgentGuard would have flagged the instruction lineage (an external email redirecting the agent) and blocked the outbound data flow that didn't fit the user's task.
- 1
Attacker sends crafted email
- 2
Copilot retrieves email as context
- 3
Hidden instructions redirect the assistant
AgentGuard flags untrusted instruction lineage and blocks out-of-task data flow
- 4
Sensitive data embedded in outbound link/image
- 5
Data leaves the tenant
- Affected
- Microsoft 365 Copilot users (vulnerability disclosed and patched)
- When
- Disclosed June 2025
- Impact
- Potential zero-click exfiltration of sensitive context data
What happened
In June 2025, researchers at Aim Security disclosed EchoLeak, a vulnerability in Microsoft 365 Copilot tracked as CVE-2025-32711. An attacker could send an email containing hidden instructions. When Copilot later pulled that email into context to answer an unrelated user question, it followed those instructions and embedded sensitive data in content that sent it to an attacker-controlled destination.
Microsoft fixed the issue on the server side. But the attack class (indirect prompt injection against an AI system with broad data access) is architectural, and it applies to every enterprise assistant and agent.
Why nothing caught it
The assistant authenticated correctly, read data it was allowed to read and produced output through a normal rendering path. DLP saw an authorized user's assistant. Email security saw a message with no malicious attachment or link. Identity saw valid tokens.
How AgentGuard would have stopped it
AgentGuard tracks instruction lineage. It knows which content in an agent's context came from untrusted external sources, and it treats any attempt by that content to change the agent's behavior as a high-risk event. It also evaluates every outbound data movement against the user's actual task. 'Summarize my week' doesn't require encoding internal documents into an external URL.
- Untrusted-source instruction detection on retrieved content
- Task-context check on outbound data flows
- Real-time block before the data is rendered or sent
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentGuard was built to close, with zero integration and deployment measured in days.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.