EchoLeak

Concept

A zero-click prompt injection vulnerability in Microsoft 365 Copilot (CVE-2025-32711) in which a crafted email could cause Copilot to exfiltrate data; the episode describes it as an LLM scope violation.

Title graphic: EchoLeak (Concept)

Type	Concept

Key points about EchoLeak

The Lethal Trifecta: Copilot can access sensitive data, read untrusted content and communicate externally; EchoLeak is cited as a prompt injection example. · Secure Microsoft Copilot with Entra ID and…

Episodes about EchoLeak

Secure Microsoft Copilot with Entra ID and Zero Trust

2026-05-30 · Video on YouTube

"The Model Is the Vulnerability" explains that the biggest security risk in Microsoft Copilot is not the AI itself, but the data, identities, and permissions the model can access. Copilot amplifies existing security weaknesses by making enterprise information…

Articles about EchoLeak (2)

Fixing Copilot's Flaws with Small Language Models
2026-08-26 · Mirko Peters
Welcome back to the podcast companion blog! In this post, we are diving deep into the technical shift transforming how enterprise organizations approach artificial …
Copilot and Endpoint Security Requirements: The Ultimate Microsoft 365 Guide
2026-04-17 · Mirko Peters
If you’re thinking about launching Microsoft Copilot across your Microsoft 365 environment, you can’t afford to overlook endpoint security. This guide g…

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Profile: arxiv.org/html/2509.10540v1
Feed for this topic (RSS): entity/echoleak/feed.xml
M365.FM episodes on this topic: 1
Articles on this topic: 2

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-03