EchoLeak: what CVE-2025-32711 changed for Microsoft 365 Copilot
Aim Security reported a zero-click disclosure bug in Microsoft 365 Copilot. Microsoft assigned CVE-2025-32711, scored it 9.3, and said the server-side fix needed no customer package.
On 11 June 2025 Microsoft published CVE-2025-32711: 'AI command injection in M365 Copilot' that lets an unauthorized attacker disclose information over a network. NVD records Microsoft's score as 9.3. Aim Security calls the chain EchoLeak and says it reported the issue in January 2025.
Microsoft told reporters the product was updated before public disclosure, that customers did not have to install a patch, and that it had no evidence of exploitation in the wild. The architectural lesson outlived the specific bug.
What the advisory says happened
Copilot retrieves mail and files to answer a question. EchoLeak hid instructions in content that retrieval would later pull in. Those instructions asked the assistant to place sensitive context somewhere an outside party could receive it. The victim did not have to open the message or click a link for the chain Aim described.
This article does not repeat the markup that carried the instructions. The CVE record is enough to name the class: untrusted text was treated as something the assistant should obey, next to data the user was allowed to see.
What could have left the tenant
Aim's write-up, and the coverage that followed, names the Copilot context: prior chats, and the mail, files and conversations the assistant is allowed to retrieve. A disclosure bug in that position is a copy of whatever the tenant already trusted the assistant to read.
Microsoft said there was no evidence attackers used it before the fix. Absence of a known campaign is not a reason to leave the assistant's scope untouched. The same shape — retrieve untrusted text, then act — is how later assistants fail.
What Microsoft already changed
The vendor advisory says the fix is server-side. There is no Copilot build number for a customer to install for CVE-2025-32711. If your tenant was on Microsoft 365 Copilot in May 2025, the specific hole described that June was closed on Microsoft's side.
Microsoft also pointed customers at controls that were already in the product: sensitivity labels and the option to stop Copilot from processing external mail. Those are scope controls. They do not depend on this CVE staying closed.
What to review even though the CVE is patched
List what Copilot, or any assistant you run, is allowed to retrieve. External mail, shared inboxes and broad SharePoint sites are the usual over-grant. Turn on the label and external-mail restrictions your admin center already documents.
For an assistant you host yourself, keep untrusted documents out of the same retrieval index as secrets, and do not let the model invent a request to an outside host from that context. Bentho's own agents should fail closed on a tool the policy did not name. That is a product boundary, not a claim that any model is immune to instructions hidden in a file.
NVD entry for CVE-2025-32711, published 11 June 2025, and Microsoft's update guide.
https://nvd.nist.gov/vuln/detail/CVE-2025-32711
Frequently asked questions
Do I install a patch for EchoLeak?
Microsoft said no customer action was required for CVE-2025-32711. The fix shipped on the service side in May 2025, before the 11 June advisory. Review Copilot's access anyway.
Was customer data stolen?
Microsoft told reporters it had no evidence of in-the-wild exploitation before the fix. The CVE is an information-disclosure bug, scored 9.3 by Microsoft, not a confirmed breach of a named tenant.
Does this affect Copilot outside Microsoft 365?
The CVE record names Microsoft 365 Copilot. Other assistants fail in the same shape when they retrieve untrusted text beside private data. Scope those separately.