Microsoft Fixes Zero-Click Vulnerability in Copilot AI

Microsoft Corporation has resolved a critical security flaw in its Copilot AI system, identified by Aim Security, a Tel Aviv-based cybersecurity firm. The vulnerability, known as EchoLeak, was characterized as a 'zero-click' flaw, meaning it could be exploited without any user interaction, according to Inc.

The EchoLeak vulnerability, assigned the identifier CVE-2025-32711, allowed unauthorized access to sensitive data within Microsoft 365 Copilot's context. This flaw was particularly dangerous as it enabled attackers to exfiltrate data without user awareness or action. The attack involved embedding malicious prompts in seemingly benign content, such as emails, which the AI system would process, leading to unintended data leaks.

Microsoft has already addressed the issue server-side, ensuring that no customer action is required. The company confirmed that there was no evidence of the vulnerability being exploited in the wild. This incident highlights the potential risks associated with AI systems and the importance of ongoing vigilance in cybersecurity measures.