{"schema_version":"0.10.0","id":"LR-2026-0336","record_version":1,"title":"EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":49.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.76,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"c20beadfb99dc70e0243fbada6f10235c8398b1729783072214443560ba01311"},"system":{"model_name":null,"model_version":null,"developer":"Microsoft","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":null,"intended_use":"enterprise workflows","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-11-23","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"The system was Microsoft 365 Copilot, a large language model assistant used in enterprise workflows. A researcher case study describes EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in which a single crafted email led to remote, unauthenticated data exfiltration. The exploit chained several bypasses: evading the XPIA classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy. The chain achieved privilege escalation across LLM trust boundaries without user interaction. The paper analyses why existing defenses failed and recommends engineering mitigations. The sources do not state when the exploit occurred, how it was detected, or what changes followed in production.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"prompt injection in a single crafted email, with the exploit chaining multiple bypasses","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"a single crafted email","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK04","RK08"],"control_chain":[{"layer":"L2","party":"harness_vendor","party_name":"Microsoft","control_id":"C2","outcome":"got_around","reason":null,"quote":"By chaining multiple bypasses--evading Microsoft’s XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy, EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction.","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":"Microsoft","control_id":"C4","outcome":"got_around","reason":null,"quote":"By chaining multiple bypasses--evading Microsoft’s XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy, EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: live production compromise. Fact: a real-world zero-click exploit against a production LLM system.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://ojs.aaai.org/index.php/AAAI-SS/article/view/36899","publisher":"The Association for the Advancement of Artificial Intelligence","date":"2025-11-23","type":"press","title":"EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System - The Association for the Advancement of Artificial Intelligence","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"C","system.lifecycle_stage":"C","system.deployment_context":"C","system.intended_use":"C","event.incident_class":"C","event.trigger":"C","event.root_cause":"C","event.root_cause_detail":"C","event.adversarial_actor":"C","event.input_provenance":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"system.lifecycle_stage":[{"source_index":0,"quote":"EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System"}],"system.deployment_context":[{"source_index":0,"quote":"EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System"}],"system.intended_use":[{"source_index":0,"quote":"Large language model (LLM) assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources."}],"event.incident_class":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"event.trigger":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"event.root_cause":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"event.root_cause_detail":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"event.adversarial_actor":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"event.input_provenance":[{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."}],"impact.severity":[{"source_index":0,"quote":"EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System"}],"impact.severity_because":[{"source_index":0,"quote":"EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System"}],"event.control_chain":[{"source_index":0,"quote":"By chaining multiple bypasses--evading Microsoft’s XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy, EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction."},{"source_index":0,"quote":"By chaining multiple bypasses--evading Microsoft’s XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy, EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction."}],"event.summary":[{"source_index":0,"quote":"Large language model (LLM) assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources."},{"source_index":0,"quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email."},{"source_index":0,"quote":"By chaining multiple bypasses--evading Microsoft’s XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy, EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction."},{"source_index":0,"quote":"We analyze why existing defenses failed, and outline a set of engineering mitigations including prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies."}]},"notes_on_gaps":"The only source is an academic symposium paper (press category) about EchoLeak; it does not state the date the exploit occurred, the date of disclosure or detection, the detection method, any model name or version, autonomy level, or agent involvement, so agent_involved and failure_class were left out. The 2025-11-23 date is the paper's publication date, not an incident date, so the timeline is empty. No counts of affected parties, records, or losses are stated, and no severity test beyond the production compromise was met. Judgements made: the adversary is treated as an external attacker because the exploit was remote and unauthenticated; harm_class privacy is inferred from data exfiltration without stated data categories; the remediation controls added (C1, C2, C4) are mapped by me from the recommended mitigations, not stated by the source; the control outcomes for C2, C4 and E2 are taken from the words 'evading', 'circumventing' and 'allowed by the content security policy'. The paper recommends mitigations but reports no changes Microsoft made, and the caught step is not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The system was an LLM assistant integrated into enterprise workflows, bridging internal and external data sources.","quote":"Large language model (LLM) assistants are increasingly integrated into enterprise workflows, raising new security concerns as they bridge internal and external data sources.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A single crafted email carried a zero-click prompt injection that enabled remote, unauthenticated data exfiltration.","quote":"This paper presents an in-depth case study of EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email.","source_index":0,"grade":"C"},{"step":"reached","text":"By chaining several bypasses, the exploit achieved full privilege escalation across LLM trust boundaries without user interaction.","quote":"By chaining multiple bypasses--evading Microsoft’s XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy, EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction.","source_index":0,"grade":"C"},{"step":"done","text":"The paper analyses why existing defenses failed and outlines engineering mitigations.","quote":"We analyze why existing defenses failed, and outline a set of engineering mitigations including prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://ojs.aaai.org/index.php/AAAI-SS/article/view/36899"]}}