EchoLeak: The First Zero-Click AI Attack on Microsoft 365 Copilot

02/09/2025

For years, “zero-click” exploits were the stuff of mobile spyware scandals. Attackers could compromise a phone without a tap or a click, leaving victims completely unaware. Now, for the first time, that same concept has crossed into the world of artificial intelligence.

Researchers at Aim Labs have discovered a serious flaw in Microsoft 365 Copilot, which they named EchoLeak. The bug, rated 9.3 on the CVSS severity scale, shows how AI assistants can be tricked into secretly leaking sensitive information without the user doing anything.

What makes EchoLeak different?

Traditional cyberattacks usually need some kind of user action: open an attachment, click a bad link, install a rogue app. EchoLeak requires none of that. Instead, it exploits the very way Copilot interprets the context it’s fed.

Here’s the unsettling part: Copilot doesn’t just look at your request. It pulls surrounding information (emails, documents, Teams chats, OneDrive files), so it can give richer answers. EchoLeak sneaks instructions into that context in ways you’d never notice: hidden text, metadata, even formatting quirks. When Copilot processes the request, it unwittingly obeys the attacker’s embedded commands.

The result? Sensitive corporate data can be packaged up and shipped off to an attacker’s server, all while the end user thinks Copilot is simply summarizing a document.

How the exploit unfolds

The attacker sends what appears to be a normal email, document, or Teams message. Hidden inside, often in metadata, invisible text, or formatting tricks, are instructions meant only for the AI. Humans won’t notice anything unusual. This “hidden bait” is the first step in manipulating the AI.
A recipient asks Copilot to perform a routine task: summarize the document, generate a report, or search for information. From the human’s perspective, this is completely ordinary. The AI is doing what it’s supposed to do, processing content and providing helpful output.
While executing the user’s request, Copilot also reads and follows the concealed commands. It retrieves sensitive information from emails, chats, SharePoint, OneDrive, or other internal resources. The user remains unaware, because the AI is operating silently in the background.
Copilot sends the harvested information to the attacker’s server, all while appearing to complete the user’s original task. No pop-ups, phishing links, or error messages appear, there’s nothing to alert the human operator.
AI assistants like Copilot are designed to pull from trusted internal sources. EchoLeak turns that trust against the organization, letting attackers leverage the AI as an unintentional insider who bridges internal data and external access.

Why this matters

The implications extend well beyond Microsoft Copilot. EchoLeak shows that the very qualities that make AI assistants useful - their context awareness, their ability to draw connections across large data sets - are also liabilities.

For businesses, that means exposure across the most sensitive data stores:

Finance teams could see budget drafts or M&A documents leaked.
Healthcare organizations risk patient data slipping out through AI-assisted summaries.
Law firms could have privileged material exfiltrated without ever suspecting a breach.

Echoes of past threats

Security veterans may find this story familiar. Two decades ago, SQL injection exploited the hidden trust between applications and databases. EchoLeak feels like its spiritual successor, only now the target is not a database but the “AI brain” embedded in enterprise tools.

Like SQL injection, EchoLeak doesn’t exploit buggy code so much as flawed assumptions: that inputs are benign, and that invisible instructions will be ignored.

Microsoft’s response

Microsoft has patched the vulnerability and reports no evidence of active exploitation. The company’s existing defenses, redaction, content filters, and classifier systems, weren’t enough in this case, underscoring how AI requires its own layer of security controls.

Organizations are being urged to tighten data loss prevention (DLP) rules, limit the types of content Copilot can access, and label sensitive documents so they’re excluded from AI processing.

Lessons for the future

EchoLeak is less about a single bug and more about a new category of risk. AI systems are not just passive tools, they’re active interpreters of context. That makes them incredibly powerful but also uniquely vulnerable.

Security teams will need to start thinking about: