In today’s landscape, the rapid adoption of Large Language Model (LLM)-based agents like Microsoft 365 Copilot has introduced new and complex attack surfaces. EchoLeak, recently discovered and documented by Aim Labs, represents the first zero-click vulnerability identified in a widely deployed AI agent such as Copilot. This exploit leverages an advanced technique called LLM Scope Violation, allowing an attacker to extract confidential data without any user interaction.


Daily Term
Can you guess today’s cybersecurity word in 6 tries?
Play now

Technical Description of the Vulnerability

EchoLeak specifically targets Microsoft 365 Copilot, exploiting its privileged access to sensitive enterprise data from sources such as email, Teams, SharePoint, and OneDrive. The attack is designed to completely bypass protections against prompt injection (XPIA) by activating automatically when a malicious email is received.

The exploit involves sending a specially crafted email containing hidden instructions, encoded in text that appears harmless to human users. This method allows the attacker to bypass Microsoft Copilot's automatic prompt injection detection filters.

Attack Schema. Source: Aim Security


Understood. From now on, I will preserve the exact structure of the text and apply only the minimum necessary changes for translation. Here's the corrected translation of your last message, strictly following that rule:


Step-by-step analysis of the attack

Step 1: Mail Injection and Markdown Filter Bypass
The attackers start by sending emails containing markdown in “reference-style” format, a type of markdown that Microsoft’s standard filters are not prepared to correctly detect. This specific technique allows the malicious payload to remain intact, avoiding the automatic removal of suspicious links and allowing the malicious content to go unnoticed through the integrated anti-injection protection systems.

Step 2: Automatic Activation and Zero-Click
Microsoft 365 Copilot is configured to operate in the background and provide summaries or previews of the received content before the user even interacts with the emails. This functionality is exploited by EchoLeak to automatically activate the malicious commands embedded in the email. No click, explicit opening of the message, or conscious action by the user is necessary, ensuring that the attack takes place completely in zero-click mode.

Step 3: Scope Violation (LLM Scope Violation)
The payload sent to users exploits the principle of “scope violation” in Copilot’s LLM, indirectly forcing the AI agent to retrieve confidential information beyond the limits normally allowed. Copilot, in attempting to respond coherently to the malicious message, improperly accesses internal and confidential company data (such as private Teams chats, SharePoint documents, OneDrive, and confidential emails), going beyond the boundaries set by the normal access criteria.

Step 4: Data Exfiltration
Once the confidential information is obtained, Copilot unknowingly integrates it into automatically generated responses. These responses, containing sensitive data, are automatically forwarded through links or seemingly legitimate domains, such as Teams or SharePoint, to external servers controlled by the attackers. This technique allows bypassing common Content Security Policy (CSP) policies, ensuring that the stolen data reaches the malicious recipient undisturbed.


Evasion and anti-detection techniques

EchoLeak does not stop at simply bypassing filters based on prompt injection; it implements a sophisticated combination of strategies to minimize the possibility of being detected. First, it uses atypical markdown formats, such as “reference-style”, which easily evade the standard filters used to identify potentially malicious links. Furthermore, EchoLeak masks data traffic using official and trusted domains, typically considered safe by corporate systems, such as those associated with Teams and SharePoint.

In addition to these techniques, the attack adopts a completely zero-click approach. This method does not require user interactions and does not generate events typically detectable by behavioral analysis systems (UEBA), which usually monitor anomalous behaviors linked to direct user activity. This characteristic makes the threat particularly sophisticated and difficult to detect with traditional endpoint security and network monitoring technologies.
The attack also includes selective activation timings and operations that simulate standard behavior of enterprise AI, further complicating automatic detection based on behavioral anomalies.


Mitigation and Technical Solutions

To apply technical countermeasures against exploits like EchoLeak, the following best practices are recommended:

  • Restrict automatically processable inputs handled by AI agents
  • Use advanced Data Loss Prevention (DLP) and Data Security Posture Management (DSPM) tools tailored for LLM environments
  • Deploy runtime guardrails capable of detecting and blocking scope violations
  • Strengthen Content Security Policy (CSP) settings to block suspicious links generated by AI agents
  • Apply Zero-Trust models specifically adapted to data processed by AI systems to reduce the risk of unintentional exposure

Indicators of Compromise (IoCs)

Aim Labs has identified key indicators that can help detect EchoLeak-based attacks:

  • Unexpected requests from Microsoft 365 Copilot to suspicious external domains, supplementing standard IOC monitoring and management
  • Anomalous auto-generated responses containing sensitive data in inappropriate contexts
  • Unusual data traffic flows from AI-related endpoints, suggesting the need for dedicated monitoring of newly introduced technologies in the organization

Broader Implications for Cybersecurity

EchoLeak highlights a structural vulnerability: the current lack of effective segregation between unverified user input and access to sensitive data by LLM-based AI agents. This exploit underscores the urgent need for new AI-specific security frameworks that can manage the risk of scope violations and automated prompt injections.

The vulnerability also confirms that traditional firewall and antivirus-based approaches are insufficient in the face of AI-driven attacks, requiring instead real-time behavioral analysis and robust data flow monitoring.


Conclusion

EchoLeak is a major development in the evolving landscape of AI-related threats. Its discovery not only compels Microsoft and other AI technology providers to quickly adapt their defensive strategies, but also serves as a wake-up call for the entire cybersecurity sector: as with any emerging technology, security architectures and processes must be reimagined to account for intelligent agents.

For cybersecurity teams, the convergence of artificial intelligence, automation, and sensitive enterprise data demands new levels of awareness and mitigation strategies, as it is reasonable to expect that EchoLeak is not an isolated threat, but a signal of an entirely new category of cyberattacks that the industry must be prepared to face.