What happened
One Email Could Make Copilot Leak Internal Data
- Chain: a classifier bypass, a link-redaction bypass, an image auto-fetch and a content security policy bypass.
- Severity: CVE-2025-32711, rated 9.3.
- Exploitation: Microsoft found no evidence of use in the wild.
- Fix: server-side, with no customer action.
Timeline
Reported in January, Fixed in May, Disclosed in June
| Date | Event | Source |
|---|---|---|
| January 2025 | Aim Labs reports the flaw privately to Microsoft | Aim Security |
| May 2025 | Microsoft deploys a server-side fix | Aim Security |
| June 11, 2025 | Microsoft publishes CVE-2025-32711 and Aim releases its research | The Hacker News |
Controls that failed
Three Defenses Failed in a Chain
| Control | Company | What failed | 137AI page |
|---|---|---|---|
| Prompt injection classifier | Microsoft | An attacker email worded as a business request got past the classifier | Behavioral Envelopes |
| Link redaction | Microsoft | Reference-style links and images were not removed | Behavioral Envelopes |
| Content security allowlist | Microsoft | An allowed Teams preview service fetched the attacker's address | Access and Authorization |
Reporting
Coordinated Disclosure Worked as Designed
| Rule | Status | Why |
|---|---|---|
| CVE program | Voluntary | Microsoft assigned a CVE and published an advisory |
| GDPR, Article 33 | Not triggered | No exploitation or personal data breach was reported |
Every rule tracked is on Incident Reporting Rules and Registries.
Response
A Server-Side Fix Before Disclosure
- Regulators and courts: None reported.
- Remediation: Microsoft fixed it server-side in May 2025, with no customer action needed.
Record
Incident Record
- Incident ID
- 2025-06-ECHOLEAK-COPILOT
- Sources
- Aim Security, EchoLeak (arXiv, 2025); The Hacker News (June 2025); BleepingComputer (June 2025)
- Last verified
- October 2026