AI developer toolsBriefPublic record
EchoLeak, M365 Copilot zero-click exfiltration (CVE-2025-32711)
Aim Labs. A crafted email caused Copilot to leak tenant data through markdown image and link fetches.
- Disclosed
What happened
- Aim Labs. A crafted email caused Copilot to leak tenant data through markdown image and link fetches. Fixed server-side.
Live scores
Live scores
CVE-2025-32711- EPSS
- 0.093
some chance of attack soon - VEDAS
- 0.532
some exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.