Executive Summary
The EchoLeak study documents a zero-click Microsoft 365 Copilot vulnerability letting an external attacker exfiltrate data from a victim's session through embedded instructions in shared content, classified as an 'LLM scope violation'.
What Happened
The EchoLeak study documents a zero-click vulnerability in Microsoft 365 Copilot where an external attacker could exfiltrate sensitive data from a victim’s Copilot session without any user interaction, by abusing how the system handled embedded instructions in shared content.[13] The authors classify the weakness as an "LLM Scope Violation," showing that poorly enforced trust boundaries in LLM agents can turn routine collaboration features into data-leak channels for enterprises and SMBs.[13]
Affected Products
- Microsoft 365 Copilot
Vulnerability / Attack Technique
Zero-click prompt injection (LLM scope violation)
Technical Mechanism
Shared content carried instructions that made Copilot read and send out data from the victim's scope.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Collaboration features became leak channels. RealGround analysis: enforce trust boundaries between external content and internal data.
Recommended Controls
- Apply Copilot fixes
- Separate external and internal content in assistant contexts
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
arXiv (Aim Labs Research): https://arxiv.org/html/2509.10540v1
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.