EchoLeak and the Emergence of CVEs for AI
CVE-2025-32711 "EchoLeak" (CVSS 9.3) was the first publicly documented zero-click prompt injection in a production LLM system (Microsoft 365 Copilot). Discovered by Aim Labs (Aim Security), disclosed to MSRC, patched via server-side update June 2025. Attack: attacker sends a crafted email to any employee; the victim's Copilot retrieves the email as RAG context during a routine query; hidden instructions execute; Copilot exfiltrates sensitive organizational data via a CSP-approved Microsoft domain. Bypassed XPIA prompt-injection filters and Copilot's link-redaction mechanisms. Aim Labs's term: "LLM Scope Violation" — external untrusted input manipulates the model to access and leak confidential data. Related: CamoLeak (CVSS 9.6, GitHub Copilot Chat) exploited the Camo image proxy; fixed by disabling image rendering entirely. GitHub Copilot RCE CVE-2025-53773. NIST has called indirect prompt injection "generative AI's greatest security flaw"; OWASP 2025 ranks it #1 threat to LLM applications. Describe the EchoLeak attack chain from email delivery to data exfiltration. Define "LLM Scope Violation" and explain why it is a new vulnerability class. Describe the three related CVEs (EchoLeak, CamoLeak, Copilot RCE) and what each reveals about the production attack surface. State the state of AI vulnerability disclosure: responsible disclosure works, but initial severity assessments have been low. Lesson 15 describes indirect prompt injection as a concept. Lesson 25 describes the first production CVE of that class. The policy lesson:…
EchoLeak and the Emergence of CVEs for AI: CVE-2025-32711 "EchoLeak" (CVSS 9.3) was the first publicly documented zero-click prompt injection in a production…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.