Part 65 · Module 9: Generation, Grounding, and Citations

Incident: One email, one image, no click

9 min read·13 Oct 2026

Module 9 · Incident file · About 30 minutes

What happened

Reported in January 2025 (red), fixed on Microsoft's servers in May (green) and published as CVE-2025-32711 on 11 June (amber), before the public write-ups (grey).

Microsoft 365 Copilot answers questions from a user's mail, files and chats with retrieval. In January 2025 researchers at Aim Labs, part of Aim Security, found a way to make it leak that data, and reported it to the Microsoft Security Response Center. They called it EchoLeak. Microsoft deployed a server-side fix in May 2025, and on 11 June 2025 published CVE-2025-32711: "AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network" (NVD record). Microsoft's own score was 9.3, critical, with no privileges and no user interaction required.

Retrieval put the attacker's email (red) beside private data (blue) in one context (amber); the answer's image address carried the data out.

The Hacker News described the attack the next day (Ravie Lakshmanan, 12 June 2025). An attacker sends an ordinary-looking email. Later the user asks Copilot a routine business question, and the retrieval step mixes the untrusted email with sensitive internal data in one context. Aim Security called this an "LLM Scope Violation". The cost is what an attacker could take, not damage seen: the article reports no evidence of malicious exploitation, and the fix needed no customer action.

What happened

The rest of this course is yours to keep