CVE-2025-32711 EchoLeak: Zero-Click Prompt Injection in Microsoft 365 Copilot Exfiltrates Enterprise Data

Technical Incident Analysis

Vulnerability CVE-2025-32711, dubbed 'EchoLeak', represents a critical evolution in prompt injection vectors targeting Microsoft 365 Copilot. Unlike traditional direct prompt injections that require interactive user prompting, EchoLeak is an automated, zero-click indirect prompt injection vulnerability. Attackers deliver malicious instruction payloads embedded in background data streams—such as inbound emails, shared OneDrive attachments, or calendar invites—that Copilot indexes for organizational contextual search. Modern defensive engineering requires robust AI Security Architecture to stop autonomous prompt execution across networked pipelines, mirroring threats documented in our analysis of the Related AI Security Incident.

When an enterprise user requests an everyday operational summary, Copilot retrieves the indexed document along with legitimate internal communications. The injected prompt overrides model safety boundaries, instructing Copilot to silently concatenate sensitive internal data (including emails, SharePoint documents, and tenant credentials) and transmit it externally via dynamic image URLs or markdown hyperlinking rendered in the chat interface.

Enterprise Blast Radius & Compliance Risks

The enterprise blast radius of EchoLeak is extensive because Microsoft 365 Copilot operates with delegated tenant permissions, accessing sensitive SharePoint sites, Teams channels, and Outlook mailboxes. An unauthenticated external sender can trigger exfiltration simply by sending an adversarial email to an employee whose Copilot daily summary workflow automatically processes inbox items. This exposure creates severe regulatory non-compliance under GDPR & CCPA Compliance, triggering mandatory breach notifications due to unauthorized processing and exfiltration of identifiable personal and corporate data.

Client-Side Mitigation via Zero-Trust Data Sanitization

Mitigating zero-click AI vulnerabilities cannot rely solely on model-level alignment or reactive prompt firewalls. Organizations must deploy pre-inference data sanitization directly at the endpoint and gateway layers. Utilizing PrivacyScrubber's zero-trust Model Context Protocol (MCP) Sanitizer, all context retrieved from local repositories and cloud stores is parsed entirely in local volatile memory (RAM). Real PII, API tokens, and confidential financial metrics are converted to reversible synthetic tokens mapped strictly in a local sessionMap before reaching the Copilot inference endpoint. If an indirect injection triggers an unauthorized exfiltration request, the payload captures only non-sensitive cryptographic placeholders, neutralizing the breach vector instantly.