EchoLeak: One Email Beat Every Classifier, a Boundary Would Have Held
CVE-2025-32711 scored 9.3 (Critical) and needed one email. No click, no attachment, no special behavior from the victim. Aim Security (Aim Labs), an Israeli AI-security firm, discovered that a single crafted email could make Microsoft 365 Copilot exfiltrate an organization's private data, and reported it through Microsoft's Security Response Center. The academic case study (Reddy and Gujral, AAAI Fall Symposium 2025) calls it the first documented real-world case of prompt injection weaponized for concrete data exfiltration in a production LLM system.
This is the failure shape that justifies building boundaries into the environment rather than bolting filters onto the model. Copilot was the exact architecture this section warns against, an agent holding privileged data, fed untrusted content, with a path to talk to the outside world. The lethal trifecta names the condition; EchoLeak is what it looks like when all three line up in a shipped product. Least privilege over the retrieval scope, or a closed egress path, would each have ended the chain that five layered filters could not.
Untrusted email reaches privileged data because nothing separated them
Aim Labs coined the term "LLM Scope Violation" for the underlying flaw. Per the arXiv study, it "occurs when an attacker's instructions embedded in untrusted content ... successfully tricks the AI system into accessing and processing privileged internal data."
The mechanism is structural. Copilot's Retrieval-Augmented Generation engine mixes untrusted attacker input, the email, with sensitive context, your chat logs, OneDrive files, SharePoint content, and Teams messages, in the same context window with no trust boundary between them. An external sender's words and your internal documents sit in the same prompt with the same authority. Once that is true, an instruction in the email can reach anything Copilot can reach.
Five chained bypasses turned one email into exfiltration
A single trick would have been caught. EchoLeak chained five, achieving what the arXiv abstract calls "full privilege escalation across LLM trust boundaries without user interaction."
| Step | The bypass |
|---|---|
| Injection | A markdown prompt-injection payload arrives as an ordinary email; Copilot ingests it into RAG context. |
| Classifier evasion | The payload is phrased to slip past Microsoft's Cross-Prompt Injection Attempt (XPIA) detection. |
| Trigger | An employee later asks Copilot a normal business question; RAG pulls the malicious email in alongside privileged data. |
| Link smuggling | Reference-style Markdown sneaks links past Copilot's link-redaction defenses. |
| Exfiltration | Auto-fetched images make outbound browser requests carrying the stolen data, routed through a Microsoft Teams/SharePoint proxy already allowlisted by the Content Security Policy. |
The last step is the sharpest. The data left over Microsoft's own trusted domains, the ones the CSP already permitted, so the leak rode out on channels the policy was built to trust. The net result, per Aim Labs, was "automatic exfiltration of sensitive and proprietary information from M365 Copilot context, without the user's awareness."
Single-point defenses each failed in turn
Microsoft had defenses. The XPIA classifier was meant to catch prompt injection; the payload was phrased around it. Link redaction was meant to strip exfiltration channels; reference-style Markdown went past it. The CSP was meant to constrain outbound traffic; the attack found an allowlisted proxy inside it. Each control was real, and each was a single point that a determined chain stepped over.
The lesson the arXiv authors draw is defense-in-depth and least privilege: "prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies." Their conclusion is blunt: single-classifier defenses and output-link redaction proved insufficient on their own.
Microsoft patched it server-side, with no in-the-wild exploitation
Microsoft fixed the vulnerability server-side in its June 2025 Patch Tuesday cycle, stated there was no evidence of exploitation in the wild, and said no customer action was required. Aim Labs reported the issue and several associated attack chains.
EchoLeak is a vulnerability in a vendor's product, not an own-goal by a team running agents. The reason it belongs in this casebook is that the failure shape is the one any team inherits when it gives an agent privileged context and an egress path without a trust boundary between trusted and untrusted input.
A boundary holds where a classifier is evaded
The control the arXiv authors name, provenance-based access control keeping untrusted external content in a separate, lower-privilege context that cannot trigger retrieval over privileged data, is an architecture property, not a filter you bolt on. It is least privilege applied to the retrieval scope. A classifier is one point that can be evaded. A boundary that untrusted content structurally cannot cross is harder to chain around.
This is the handbook's standing position: environments hold where guardrails leak. The egress path is the other half. EchoLeak exfiltrated through a CSP-allowlisted domain, which is precisely the case for controlling egress at the environment level rather than trusting a content policy to enumerate every safe destination. When the data has nowhere to go, the chain ends at the last step. For the general method of pulling any one link out of an attack chain, see breaking the chain.