The setup: Microsoft 365 Copilot is integrated into Outlook, Word, PowerPoint, and Teams. It reads documents and emails on behalf of the user to summarize and answer questions. That's its designed purpose.
The attack: An attacker sends a single crafted email to the victim. The email looks completely normal to the human. Hidden inside are instructions to Copilot. When Copilot automatically processes the email as part of normal M365 operation, it follows the hidden instructions: access the victim's internal files and exfiltrate their contents to an attacker-controlled server.
The exfiltration mechanism: The attack used reference-style Markdown to embed an image link pointing to the attacker's server, encoding the stolen data in the URL. This bypassed Microsoft's XPIA (Cross Prompt Injection Attempt) classifier. The image auto-fetched via a Microsoft Teams proxy that was already whitelisted in Copilot's content security policy.
Zero user interaction required. Victim didn't click. Didn't open an attachment. Didn't reply. Copilot processed it automatically.
EchoLeak's CVSS 9.3 rating reflected partly that Copilot had broad access to the entire victim M365 environment. OWASP Mitigation #4 — least privilege — applied before deployment would have limited the blast radius even after the injection succeeded. Scope the AI's data access to the minimum it actually needs.