EchoLeak, replayed in Sabline

EchoLeak, CVE-2025-32711, 2025-06-11. Also called CVE-2025-32711, the zero-click Microsoft 365 Copilot leak. (The name in use.) Verdict: OUT OF SCOPE - prompt injection where no code ran - listed so the boundary is visible, not counted as a gap.

Note

This is the shape of the attack, not a claim that Sabline would have prevented the real event. The real one happened in a language, a package manager, a build system or an agent framework that Sabline neither runs nor bounds. What this page shows is narrower and checkable: the same shape written in Sabline, the command, what the runtime printed, and the one line of budget that did the work - or, where nothing here addresses the shape, that.

What happened #

Aim Labs reported a zero-click vulnerability in Microsoft 365 Copilot, assigned CVE-2025-32711 with a CVSS score of 9.3. An email worded to read as a normal request to the recipient (bypassing Microsoft's XPIA classifier), needing no action from the victim, was pulled in by Copilot's retrieval when the user later asked Copilot a question; its hidden instructions made Copilot put sensitive data from the user's context into an image link, fetched automatically through a Microsoft Teams URL allowed by the content security policy, sending the data to the attacker's server. The researchers call the underlying pattern an "LLM scope violation". Microsoft fixed it server-side and states there was no exploitation in the wild.

Sources #

CVE-2025-32711 - Microsoft's advisory and CVE record (Microsoft is the CNA): the CVE id, the CVSS score, the acknowledgement of Aim Labs, the server-side fix, and that there was no exploitation in the wild.
EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System - Pavan Reddy and Aditya Sanjay Gujral, arXiv:2509.10540, published at the AAAI Fall Symposium Series 2025: the email phrased as a normal request to the human recipient and so past the XPIA classifier, the ordinary retrieval pass that pulled it into Copilot's context, the reference-style image link the chat UI fetches as it renders, and the Microsoft Teams preview URL allowed by the content security policy. The account above rests on this paper.
Breaking down 'EchoLeak', the first zero-click AI vulnerability enabling data exfiltration in Microsoft 365 Copilot - Aim Labs' own report, which describes the vector and the scope-violation framing. The page has not served the article since August 2025 (it answers HTTP 403 now); it is cited as an archived copy, read through the Wayback Machine.

The entry, its program and its recorded run are in incidents/echoleak-m365-copilot/. Every incident, with its verdict, is in the catalogue.