Understand this story
Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot. An attacker only needs to send the victim one email to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which sequentially bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM Scope Violation and believes that similar design flaws may also exist in other RAG-based chatbots and AI agents. Aim Labs said Microsoft has confirmed that no customers were affected.
AI-generated from public reports
Latest development · Report
Aim Labs discloses the complete attack chain of the M365 Copilot zero-click vulnerability EchoLeakDevelopments
1 confirmed developments
Aim Labs discloses M365 Copilot zero-click vulnerability EchoLeak
Source:Cato AI Labs
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
May 31
Cato AI LabsFirst-partySelected
Aim Labs discloses the complete attack chain of the M365 Copilot zero-click vulnerability EchoLeak
Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot: an attacker only needs to send a single email to the victim to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which in sequence bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM Scope Violation and believes that similar design flaws may also exist in other RAG-based chatbots and AI agents, and states that Microsoft has confirmed that no customers were affected.