AI system vulnerability
Critical
EchoLeak: Leaking data from Microsoft 365 Copilot with a single email
Aim Labs showed that M365 Copilot could follow hidden instructions in an incoming email and carry internal data out of the organisation without the user clicking anything. Microsoft fixed it server-side.
CVE-2025-32711