Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
EchoLeak is a new attack method that has been described as a "zero-click" artificial intelligence (AI) vulnerability that enables malicious actors to steal confidential information from the context of Microsoft 365 (M365) Copilot without requiring any user intervention.
The CVE identifier CVE-2025-32711 (CVSS score: 9.3) has been assigned to the critical-rated vulnerability. Microsoft has already resolved it, and no consumer action is necessary. There is no proof that the flaw was intentionally used in the wild.
According to a business advisory issued on Wednesday, an unauthorized attacker can reveal information over a network by using AI command injection in M365 Copilot. Since then, it has been included in Microsoft's June 2025 Patch Tuesday list, bringing the total number of corr...