Full Report
A new attack dubbed 'EchoLeak' is the first known zero-click AI vulnerability that enables attackers to exfiltrate sensitive data from Microsoft 365 Copilot from a user's context without interaction. [...]
Analysis Summary
# Vulnerability: Zero-Click Data Exfiltration via Microsoft 365 Copilot Prompt Injection (EchoLeak)
## CVE Details
- CVE ID: **Not explicitly provided in the context.** (This summary is based on a reported vulnerability sometimes referred to as EchoLeak, indicating a fix was likely applied.)
- CVSS Score: **Not explicitly provided in the context.**
- CWE: **CWE-860: Unintended/Unenforced Change of Content by Mid-Tier Servers (Potential for injection/SSRF-like behavior via LLM response formatting)** (Inferred due to RAG context manipulation leading to exfiltration)
## Affected Systems
- Products: Microsoft 365 Copilot (utilizing Retrieval-Augmented Generation - RAG)
- Versions: Vulnerable state prior to the specific patch addressing this issue (likely June 2025 or prior).
- Configurations: Environments where Copilot ingests and processes organizational data and relies on RAG mechanisms that process attacker-controlled structured output (like markdown).
## Vulnerability Description
This is a **zero-click data exfiltration vulnerability** stemming from the integration of Retrieval-Augmented Generation (RAG) within Microsoft 365 Copilot. An attacker can craft malicious data (e.g., in an email) which, when later prompted by Copilot, is included in the LLM's context. Through prompt injection techniques, the attacker can "trick" the LLM into generating a response formatted as a markdown image link. If the target user then opens or views this response, the malformed link (containing sensitive internal data embedded in the URL) is automatically requested by the browser. The attack leverages the fact that URLs related to Microsoft Teams and SharePoint are trusted by the Content Security Policy (CSP), allowing the crafted request—now including the exfiltrated user context or documents retrieved by RAG—to be sent to an attacker-controlled external server via the image request mechanism.
## Exploitation
- Status: **Exploited in the wild** (Implied by context describing a fixed flaw and immediate reporting after discovery/patching, although the article doesn't explicitly confirm exploitation *before* the fix.)
- Complexity: **Low** (Described as a "zero-click" vulnerability where execution relies on the legitimate retrieval mechanism triggered by the crafted response.)
- Attack Vector: **Network** (The response payload triggers external network communication/exfiltration.)
## Impact
- Confidentiality: **High** (Allows unauthorized exfiltration of sensitive internal data retrieved by Copilot/RAG.)
- Integrity: **Low** (Focus is on data theft, not modification of systems, although data modification within the LLM context is abused.)
- Availability: **Low** (Minimal direct impact on service availability.)
## Remediation
### Patches
- **Patches addressing this vulnerability were included in the Microsoft June 2025 timeframe updates.** (Specific patch KB/version not available, but referenced as fixed in recent servicing.)
### Workarounds
1. **Implement granular input scoping** to limit what data Copilot can access during RAG queries.
2. **Strengthen prompt injection filters** (input validation).
3. **Apply post-processing filters on LLM output** specifically designed to block responses that contain external links or structured data that could trigger external requests.
4. **Configure RAG engines to exclude external communication** sources to prevent malicious prompts from being retrieved in the first place.
## Detection
- **Indicators of Compromise (IoCs):** Outbound network connections generated from internal endpoints attempting to resolve non-standard external domains disguised as image requests originating from interactions with Copilot outputs. Look for URL structures containing encoded sensitive data being sent to external hosts.
- **Detection Methods and Tools:** Advanced DLP solutions monitoring outbound HTTP/S traffic for malformed URL structures commonly associated with markdown/image payload embedding. Monitoring LLM output logs for the presence of attacker-constructed URLs leveraging trusted domains (Teams/SharePoint) in a way that suggests data exfiltration embedding.
## References
- Vendor advisory implied by the reference to Microsoft June 2025 Patch Tuesday fixes.
- Relevant links - defanged:
- bleepingcomputer com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/