{
 "id": "TR-2026-002",
 "status": "published",
 "title": "EchoLeak: a zero-click email exfiltrates Microsoft 365 Copilot's context",
 "date": "2025-06-11",
 "window": "Disclosed 11 Jun 2025; fixed server-side by Microsoft before publication",
 "ai_role": "target",
 "category": "red_team",
 "summary": "A crafted email the user never opens is retrieved by Microsoft 365 Copilot's RAG and instructs it to embed sensitive context in an image URL fetched through an allowed Microsoft domain, bypassing the content-security policy. No user interaction. Microsoft fixed it server-side (CVE-2025-32711, CVSS 9.3).",
 "attacker": {
  "description": "Security researchers (Aim Security / Aim Labs), proof of concept"
 },
 "defender": {
  "description": "Microsoft — fixed server-side before publication"
 },
 "scale": "Data from the user's Copilot context; zero-click",
 "impact": "Exfiltration of retrieved context with no user interaction",
 "tactics": [
  "TA0001",
  "TA0005",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-06-11",
   "text": "Aim Security details EchoLeak; Microsoft has already fixed it server-side (CVE-2025-32711)",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "RAG over inbound, unsolicited content means a message the user never opens can still drive the agent — scope what retrieval can reach.",
  "A CSP that trusts a vendor's own domains can still carry data out; treat image/redirect fetches as an egress channel."
 ],
 "models_named": [],
 "related_agents": [
  "microsoft-microsoft-365-copilot-for-government"
 ],
 "cves": [
  "CVE-2025-32711"
 ],
 "vendor_response": "Fixed server-side by Microsoft before publication; CVE-2025-32711",
 "sources": [
  {
   "title": "Researchers Detail Zero-Click Copilot Exploit 'EchoLeak'",
   "url": "https://darkreading.com/application-security/researchers-detail-zero-click-copilot-exploit-echoleak",
   "outlet": "Dark Reading",
   "date": "2025-06-11"
  }
 ],
 "reviewer": null,
 "checked_on": null
}