EchoLeak: How a Single Email Turned Microsoft 365 Copilot Into a Zero-Click Exfiltration Channel
Aim Security's EchoLeak disclosure showed how an unopened email could steer Microsoft 365 Copilot to retrieve internal data and carry it out through a rendered Markdown reference, breaking the boundary between untrusted content and privileged context.
6 min read↗