Congratulations On Your Mature Collaboration Strategy. You've Built A Bomb.

Pillar 01 · Security

A single email did it. Nobody opened an attachment. Nobody clicked a link. Nobody did anything at all. The email simply arrived, and Microsoft 365 Copilot quietly read its instructions and exfiltrated sensitive data on the attacker's behalf.

That is EchoLeak — CVE-2025-32711, documented by Pavan Reddy and Aditya Sanjay Gujral. It is being discussed as a Copilot bug, which is a bit like discussing the Titanic as an ice-management incident. The bug is real. It is also not the story.

The story is who was standing in the blast radius. And the answer, delightfully, is the people who did everything right.

The reward for doing everything the vendor asked

Somewhere there is a large organization — there are many, but picture a specific one — that spent the last decade consolidating onto a single collaboration stack. Email, chat, files, approvals, the entire institutional memory of who agreed to what, all migrated lovingly into Teams and Outlook. This was sold as maturity. Digital transformation. A single source of truth. There were slide decks. The slide decks had checkmarks.

What they actually built was a standing corpus of plaintext containing every sensitive thing the company knows, indexed and searchable, sitting in one place.

Then the vendor offered to connect an AI assistant to all of it. With your privileges. So it could help you find things.

Read that sentence again, because the second half is also the exploit. "So the AI can find anything across your entire organization" and "so an attacker can find anything across your entire organization" are the same feature. EchoLeak is what happens when someone other than you phrases the query.

Maturity is the risk multiplier, which is a fun sentence to write

Security usually rewards diligence. The locked-down, fully-patched, single-vendor shop is supposed to be the safe one. EchoLeak inverts this with real elegance.

The more completely you committed to the platform, the bigger the corpus. The bigger the corpus, the broader the retrieval surface. The broader the retrieval surface, the more a single zero-click injection pays out. Total commitment to the workflow engine is not a defense. It is a yield optimization — for the attacker.

Meanwhile the disorganized shop running a chaotic mix of half-integrated tools has a smaller blast radius, entirely by accident. Their data is scattered across systems that don't talk to each other, retrievable by no single agent, exfiltrable by no single query. They didn't earn this. They were just too dysfunctional to centralize. In the EchoLeak threat model, that dysfunction is a security control.

Somewhere a CISO who has spent three years and a great deal of money "rationalizing the tool sprawl" is going to have to sit with that.

The trust boundary was always a vibe

Here is the part that should have kept people up at night before EchoLeak, and didn't.

The assistant cannot tell where text came from. A sentence from your CFO and a sentence from a stranger's email arrive in the model's context as the same thing: text. The notion that the model would treat one as authoritative and the other as suspicious was never an architectural property. It was a hope. A trained reflex. Microsoft even built a classifier — XPIA, the Cross Prompt Injection Attempt detector — specifically to enforce this boundary by guessing.

The exploit walked past it. Of course it did. It is a guess. The injection then slipped through link redaction using reference-style Markdown, encoded the stolen data into an auto-fetched image URL, and laundered the egress through a Teams proxy the content security policy already trusted. Four bypasses, each defeating a control that was working as designed. The composition is what failed, and the composition is what you bought.

None of this created the exposure. The exposure was always there. For years the only thing standing between "all our collaboration data in one searchable place" and "all our collaboration data leaving in one searchable query" was that nobody had bothered to wire an autonomous agent to the corpus yet. Copilot wired it up. EchoLeak just collected on a debt the architecture had been carrying since the first migration kickoff meeting.

The mitigations are an apology

Read the paper's recommendations and notice what they quietly concede. Prompt partitioning. Provenance-based access control. Least privilege. Strict content security policies. Defense-in-depth.

Every one of those is the industry admitting the model layer cannot be trusted to police itself. You do not partition prompts and enforce provenance and lock down egress because the assistant is reliable. You do it because it is not, and never was, and the marketing simply declined to mention it. These are not features. They are the safety rails you install after you have looked at the cliff you already drove the org onto.

There is a tidier version of all this for anyone keeping a threat model. A credulous reasoning engine, with broad retrieval rights, over a standing plaintext corpus, with an open egress path, is not an AI strategy. It is a confused deputy holding your credentials and waiting for instructions from literally anyone. EchoLeak was one attacker being polite enough to send the instructions by email.

The uncomfortable corollary, free of charge: a single misconfiguration away from mass exfiltration by a stranger is also zero misconfigurations away from lawful access by whoever can compel the operator. Same corpus. Same open boundary. Different letterhead on the request.

The lesson is not that Microsoft shipped a bug. Microsoft shipped exactly what was on the slide deck. The lesson is that an AI assistant inherits the security posture of the data architecture underneath it — and a generation of "mature" enterprises spent ten years and several budgets building the worst possible architecture to put an assistant on top of. The bomb was assembled in plain sight, on purpose, with executive sponsorship. EchoLeak just rang the doorbell.

[2509.10540] EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Bias Declaration: I work in data sovereignty and I think most enterprise data architectures are a compellability incident with a calendar invite. I have commercial views in this space. The EchoLeak analysis is drawn entirely from Reddy and Gujral (arXiv:2509.10540); the contempt is my own.