How an Email Could Trick Microsoft Copilot Into Leaking Data

As AI assistants gain access to corporate emails, documents and other confidential information, new security risks emerge. But that doesn’t mean we should stop adopting AI. Every technology comes with risks. What matters is understanding them and being aware of risks. EchoLeak is a notable example of a security vulnerability discovered by researchers at Aim Security in 2025.

The attack started with an email containing hidden instructions. These instructions were not meant for the employee receiving the email, but for Microsoft Copilot, the employee’s AI assistant.

The instructions were hidden in Markdown, a common way of formatting text, links, and images in emails and other content. On its own, Markdown is not suspicious.

When the employee later asked Copilot a question, Copilot could find that email while searching for relevant information. The problem was that Copilot could mistake the hidden instructions for commands, rather than treating them as ordinary email content. As a result, an attacker could trick Copilot into finding sensitive information in documents and emails the employee was allowed to access and sending it to the attacker.

But how could the attacker receive that information?

The trick involved an image link. Normally, when an application loads an image from the internet, it sends a request to the server hosting that image. The attacker used this behavior to their advantage. By tricking Copilot, they could make it insert sensitive information into a specially created Markdown image link. A user could ask Copilot a harmless question about some documents or emails. When Copilot displayed its response with that Markdown image link, the application automatically attempted to load the image. In doing so, the sensitive information could be sent to the attacker’s server. The attack also used a Microsoft Teams service that acts as a middleman when loading content from the internet. This helped the attacker get around security restrictions that would normally block such requests. The employee did not even need to open the malicious email for the attack to work.

This technique is known as indirect prompt injection. It happens when an AI assistant reads information from an outside source, such as an email or document, and mistakenly follows instructions hidden inside it. The important difference is that the instructions do not come from the user. They come from content the AI was only supposed to read. Microsoft fixed the vulnerability before it was publicly disclosed in June 2025.

The broader lesson is not that AI assistants are inherently unsafe. Emails can be hacked, passwords can be stolen, and traditional software contains vulnerabilities. AI systems are no exception. As AI assistants gain access to more information and take on more responsibilities, understanding how they can be manipulated becomes increasingly important. Or, at the very least, it is important to be aware that they have issues too, no matter how smart they might seem.

Source: EchoLeak — CVE-2025-32711