Cases › security breach › LR-2026-0336

EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot

Preliminary Why: Publisher not yet named · subject to change

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

No source states: loss or records, agent tool, could do, deployer, industry.

Severity major: Test: live production compromise. Fact: a real-world zero-click exploit against a production LLM system.

The system was Microsoft 365 Copilot, a large language model assistant used in enterprise workflows. A researcher case study describes EchoLeak (CVE-2025-32711), a zero-click prompt injection vulnerability in which a single crafted email led to remote, unauthenticated data exfiltration. The exploit chained several bypasses: evading the XPIA classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy. The chain achieved privilege escalation across LLM trust boundaries without user interaction. The paper analyses why existing defenses failed and recommends engineering mitigations. The sources do not state when the exploit occurred, how it was detected, or what changes followed in production.source

LR-2026-0336 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON