PulseAugur
EN
LIVE 05:43:56

EchoLeak vulnerability enables zero-click data theft from Microsoft Copilot

By PulseAugur Editorial · [1 sources] ·

A critical vulnerability named EchoLeak, patched by Microsoft in June 2025, allowed for zero-click data theft from Microsoft 365 Copilot. The exploit involved an email with malicious markdown instructions that, when processed by Copilot during a user's query, caused the AI to exfiltrate sensitive data via an outbound URL. This attack bypasses traditional user interaction, as the victim does not need to open the email or click any links, highlighting a significant security risk in Retrieval-Augmented Generation (RAG) systems. AI

IMPACT Highlights critical security flaws in RAG systems, necessitating robust data exfiltration controls and treating all retrieved content as untrusted.

RANK_REASON The article details a specific vulnerability and its patch in a widely used AI-powered product, rather than a new model release or fundamental research.

Read on dev.to — LLM tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

EchoLeak vulnerability enables zero-click data theft from Microsoft Copilot

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The article details a specific vulnerability and its patch in a widely used AI-powered product, rather than a new model release or fundamental research.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
safety, product
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
92 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — LLM tag TIER_1 English(EN) · Brenn Hill ·

    EchoLeak: zero-click data theft from an AI assistant

    <p>In June 2025, Microsoft patched a vulnerability in Microsoft 365 Copilot tracked as <a href="https://nvd.nist.gov/vuln/detail/cve-2025-32711" rel="noopener noreferrer">CVE-2025-32711</a>, CVSS 9.3, and named <strong>EchoLeak</strong> by the researchers who found it at Aim Labs…

RELATED ENTITIES

RELATED TOPICS