Traces / TR-2026-002
agent was the target · researcher disclosure · unreviewed
EchoLeak: a zero-click email exfiltrates Microsoft 365 Copilot's context
A crafted email the user never opens is retrieved by Microsoft 365 Copilot's RAG and instructs it to embed sensitive context in an image URL fetched through an allowed Microsoft domain, bypassing the content-security policy. No user interaction. Microsoft fixed it server-side (CVE-2025-32711, CVSS 9.3).
Timeline
2025-06-11 Aim Security details EchoLeak; Microsoft has already fixed it server-side (CVE-2025-32711) · Dark Reading T2
What defenders can take from it
- RAG over inbound, unsolicited content means a message the user never opens can still drive the agent — scope what retrieval can reach.
- A CSP that trusts a vendor's own domains can still carry data out; treat image/redirect fetches as an egress channel.
The maintainer's reading of the public reports, not advice specific to your deployment.
Sources · 1
- Researchers Detail Zero-Click Copilot Exploit 'EchoLeak' — Dark Reading, 2025-06-11 ○ On 2026-10-26, this link could not be verified (bot wall).
Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.
Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.