Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Hijacked by injectionPI-0011

Zero-click email injection could make Microsoft 365 Copilot leak organizational data (EchoLeak)

Researchers at Aim Security showed that a specially crafted email could carry hidden instructions that Microsoft 365 Copilot later followed, pulling data from the victim's mail, files and chats and sending it to an outside server without any click by the user. Microsoft assigned the flaw a critical CVE (CVE-2025-32711), fixed it server-side and said no customers were affected.

Reported June 11, 2025Happened in January 2025Discovered January 2025Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm: No harm foundAdds nothing to the index.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Controlled testDeveloper confirmedInitiated by Outside attacker
Near miss

Near miss. Harm was plausible but prevented. It is rated only on what actually happened.

Not counted: no harm foundEffect on the index

Sources

How we know

6 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryCVE-2025-32711: M365 Copilot Information Disclosure VulnerabilityMicrosoft Security Response Center · June 11, 2025msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711
  2. primaryCVE-2025-32711 record (Microsoft as CNA)CVE Program (Microsoft CNA record) · June 11, 2025cveawg.mitre.org/api/cve/CVE-2025-32711
  3. researchEchoLeak: zero-click AI vulnerability in Microsoft 365 Copilot (Aim Labs blog post; returned HTTP 403 when checked 3 Oct 2026)Aim Security (Aim Labs) · June 2025aim.security/lp/aim-labs-echoleak-blogpost
  4. newsZero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User InteractionThe Hacker News · June 12, 2025thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html
  5. newsMicrosoft Copilot zero-click attack raises alarms about AI agent securityFortune · June 11, 2025fortune.com/2025/06/11/microsoft-copilot-vulnerability-ai-agents-echoleak-hacki…
  6. newsResearchers Detail Zero-Click Copilot Exploit 'EchoLeak'Dark Reading · June 12, 2025darkreading.com/application-security/researchers-detail-zero-click-copilot-expl…

Why this rating

No harm found; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

No harm found

The researchers' attack chain worked in their own test setup; Microsoft said it fixed the flaw before customers were affected, and no customer compromise is known.

Scope: Microsoft stated customers were unaffected and it had no evidence of exploitation.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

In the demonstration Copilot followed injected instructions and exfiltrated data it could already access, staying inside its permissions.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

The disclosed and patched controlled test found no exploitation within the reported scope, so impact is none found. Control level 2 reflects following injected instructions within permissions.

The scales

Effect on the index

It does not count toward the June 16 reading

The reading for the week to June 16, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: no harm found. 5 other records behind the reading for that week.

The arithmetic
The reading for the week of June 16, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band— (none counting)— (none counting)
Harms at that level, nposition in the band00
Highest control level breachedsets the reading only when no harm counts33
Readingrounded down3 Control failures only3 Control failures only
Inside the window of 4 weekly readings
Week toReadingBand
June 16, 20253Control failures only
June 23, 20252Control failures only
June 30, 20252Control failures only
July 7, 20252Control failures only

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

5 logged. Every change to a rating is logged here, with the reason.

  1. v5
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v4
    Oct. 3, 2026

    Event and discovery dates set to January 2025, when Aim found the flaw (Fortune); it was disclosed on 11 Jun 2025. Added the CVE-2025-32711 record. The Aim Labs post returned HTTP 403 when checked on 3 Oct 2026 and is marked unavailable in its title. Dated The Hacker News and Dark Reading articles (12 Jun 2025), corrected the Fortune title and reworded the impact note. A Cato Networks rehost of Aim's write-up was not added: its text could not be read. Ratings unchanged.

  3. v3
    Oct. 2, 2026

    Added first-hand sources: Microsoft's CVE-2025-32711 advisory and Aim Labs' EchoLeak write-up.

  4. v2
    Sept. 30, 2026

    Rated: impact none found; control type instruction violation.

  5. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Zero-click email injection could make Microsoft 365 Copilot leak organizational data (EchoLeak).” Record PI-0011. Reported June 11, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0011