First ever security flaw detected in an AI agent, could allow hacker to attack user via email

India Today

12-06-2025

In a first-of-its-kind discovery, cybersecurity researchers have identified a major security flaw in a Microsoft 365 Copilot AI agent. The vulnerability, called EchoLeak, allowed attackers to silently steal sensitive data from a user's environment by simply sending them an email. No clicks, downloads, or user actions were needed. The issue was uncovered by researchers at Aim Labs in January 2025 and reported to Microsoft. In May, the tech giant fixed the flaw server-side, meaning users didn't need to take any action. Microsoft also confirmed that no customers were impacted, and there is no evidence that the flaw was used in real-world attacks.advertisementStill, the discovery marks a significant turning point for AI security, as EchoLeak is believed to be the first-ever zero-click AI vulnerability affecting a large language model-based assistant.How the EchoLeak attack worksMicrosoft 365 Copilot is built into Office apps like Word, Excel, Outlook, and Teams. It uses AI to generate content, analyse data, and answer questions using internal documents, emails, and chats. It relies on OpenAI's models and Microsoft Graph to function. EchoLeak targeted how this assistant processes information from emails and documents when answering user questions.
Here's how the attack worked:-An attacker sends a business-like email to the target. The email contains text that looks normal but hides a special prompt, designed to confuse the AI assistant.-When the user later asks a related question to Copilot, the system retrieves the earlier email using its Retrieval-Augmented Generation (RAG) engine, thinking it's relevant to the query.advertisement-At this point, the hidden prompt is activated. It silently instructs the AI to extract internal data and place it in a link or image.-When the email is displayed, the embedded link is automatically accessed by the browser – sending internal data to the attacker's server without the user realising anything has gone wrong.Some of the markdown image formats used in the attack are designed to make browsers send automatic requests, which made this data exfiltration possible.Though Microsoft uses Content Security Policies (CSP) to block requests to unknown websites, services like Microsoft Teams and SharePoint are trusted by default. This allowed attackers to bypass certain defences.A new kind of AI vulnerabilityEchoLeak is more than just a software bug – it introduces a new class of threats known as LLM Scope Violations. This term refers to flaws in how large language models handle and leak information without being directly instructed by a user. In its report, Aim Labs warned that these kinds of vulnerabilities are especially dangerous in enterprise environments, where AI agents are deeply integrated into internal systems.'This attack chain showcases a new exploitation technique... by leveraging internal model mechanics,' Aim Labs said. The team believes the same risk could exist in other RAG-based AI systems, not just Microsoft's. Because EchoLeak required no user interaction and could work in fully automated ways, Aim Labs says it highlights the kind of threats that might become more common as AI becomes more embedded in business operations.advertisementMicrosoft labelled the vulnerability as critical, assigned it CVE-2025-32711, and released a server-side fix in May. The company reassured users that no exploit had taken place and that the issue is now resolved.Even though no damage was done, researchers say the warning is clear. 'The increasing complexity and deeper integration of LLM applications into business workflows are already overwhelming traditional defences,' the report from Aim Labs reads.