That distinction changes the operational response. There is no Windows cumulative update, Microsoft 365 Apps build number or customer-installed hotfix named in the submitted report. These were primarily service-side Copilot fixes. Organizations should treat them as a reminder to review Copilot permissions and AI security controls, rather than as an August Patch Tuesday deployment item.
Microsoft’s own security record identifies EchoLeak as CVE-2025-32711, an AI command-injection vulnerability in Microsoft 365 Copilot that could disclose information over a network. Microsoft assigned the issue a 9.3 Critical score, while the National Vulnerability Database lists a 7.5 High score under its separate scoring analysis. The disagreement is worth noting: Microsoft’s rating reflects the possibility that an unauthenticated attacker could induce Copilot to expose highly sensitive information across a security boundary; NVD’s calculation treats the scope differently.
EchoLeak targeted Microsoft 365 Copilot through untrusted email content
Aim Security’s EchoLeak research described an indirect prompt injection: instructions hidden in content Copilot was allowed to read, rather than a command deliberately entered by the user. A crafted email could tell the model to search accessible Microsoft 365 data and package the result in a form that caused a browser-side request to an attacker-controlled destination.
The important feature was the lack of an overt prompt from the victim. Le Monde, reporting on Aim Security’s disclosure in June 2025, described a lab attack in which Copilot processed a malicious email during its handling of mailbox content. In the researchers’ demonstration, the email’s concealed text attempted to redirect Copilot from assisting the user toward searching for sensitive data available in that user’s context.
This is not an Outlook remote-code-execution bug, nor did it mean a malicious email could install malware on a Windows PC. The risk existed in the boundary between an AI assistant’s access to internal content and its interpretation of external content. A user’s Copilot permissions were effectively the prize: mailbox messages, OneDrive files, SharePoint documents, meetings and chats could be valuable if the assistant could be manipulated into retrieving and exporting them.
Microsoft’s CVE entry marks CVE-2025-32711 as an exclusively hosted service issue. In practical terms, IT teams did not need to distribute a client patch to close the identified EchoLeak path. But that does not remove the underlying exposure created when a generative AI service can search broad sets of business data on a user’s behalf.
Microsoft said the flaw was fixed before public disclosure, and reporting at the time said the company had found no evidence that customers had been affected. That statement covers known exploitation, not a guarantee that the attack class has disappeared. Prompt injection is a recurring design problem for AI systems that must read both trusted and untrusted information.
Reprompt was a different, consumer-Copilot one-click path
The submitted report also names Reprompt, Varonis Threat Labs’ January 2026 disclosure. It was not an EchoLeak variant delivered through a hidden email instruction, and it did not initially target Microsoft 365 Copilot enterprise tenants.
According to Varonis and independently reported by Windows Central, Reprompt abused Copilot’s URL q parameter, which could populate and execute a prompt from a link. A victim had to click a seemingly legitimate Copilot link, but did not need to type a request or interact with the Copilot chat after that point. Varonis said the malicious flow could continue through chained follow-up requests and could attempt to extract data from the victim’s Copilot context.
Microsoft patched the Reprompt issue on January 13, 2026, according to Windows Central’s reporting on the disclosure. Varonis said at the time that Reprompt affected Copilot Personal and that Microsoft 365 Copilot enterprise customers were not affected by that particular flaw.
That is a far narrower claim than “Microsoft released updates across consumer and corporate platforms” for the same vulnerability. The consumer service and enterprise Microsoft 365 Copilot have overlapping branding but different data sources, controls and threat models. Treating them as one product obscures who faced which risk.
Reprompt also illustrates why perimeter controls can struggle with AI-specific attacks. A secure-looking Microsoft domain can still carry an unwanted instruction in a URL parameter. Traditional anti-malware software is built to identify malicious files, code and known exploit behavior; it does not automatically understand whether a natural-language instruction handed to an AI service is safe, malicious or an attempt to cause data exfiltration.
SearchLeak brought the concern back to enterprise data
Varonis subsequently disclosed SearchLeak in June 2026, a separate chain affecting Microsoft 365 Copilot Enterprise Search. Microsoft remediated it under CVE-2026-42824 and rated it Critical, according to Varonis’ technical disclosure.
SearchLeak matters because it targeted the part of Microsoft 365 that can index organizational content. Varonis described a chain involving parameter-to-prompt injection, an HTML rendering race condition and server-side request forgery through an allowed Bing image-search path. In the researcher’s proof of concept, one click could lead Copilot Enterprise Search to retrieve information from email, calendars, SharePoint and OneDrive, then transfer data outward.
The three findings should not be collapsed into a single “hidden text prompts” vulnerability:
- EchoLeak was a zero-click indirect-prompt-injection issue in Microsoft 365 Copilot, disclosed and patched in June 2025 as CVE-2025-32711.
- Reprompt was a single-click URL parameter attack against Copilot Personal, disclosed in January 2026 and patched on January 13, 2026.
- SearchLeak was a later enterprise-search chain involving more than prompt injection alone, disclosed and remediated in June 2026 as CVE-2026-42824.
The common thread is that Copilot can act on a user’s accessible information. The different delivery methods are operationally important: mail security and external-content controls bear more directly on EchoLeak-style attacks, while link protections and browser-side inspection matter more for Reprompt and SearchLeak-style chains.
Server-side remediation does not replace access governance
Microsoft’s current guidance on indirect prompt injection recommends defense in depth rather than reliance on one model-level safeguard. The company describes Prompt Shields, data spotlighting or marking of external content, runtime monitoring, tool-chain analysis and information-flow controls as complementary protections.
That guidance is also an admission of the practical limit: a model cannot perfectly distinguish a legitimate instruction from hostile instructions embedded in documents, web pages, messages or plugin output. Security teams should design on the assumption that external content may eventually influence an AI workflow.
For Microsoft 365 administrators, the highest-value steps are familiar but take on more urgency with Copilot enabled:
- Review SharePoint, OneDrive, Teams and Exchange permissions, especially broad groups, anonymous sharing and stale project sites, because Copilot can only expose data that a user or service identity can already reach.
- Limit Copilot access to high-risk repositories until their ownership, sensitivity labels and permissions are understood, rather than assuming existing access sprawl becomes harmless when surfaced through natural-language search.
- Use Microsoft Purview sensitivity labels, data loss prevention policies, audit logging and alerting to monitor unusual access patterns around sensitive files, mailbox content and AI-assisted workflows.
- Train users to treat unsolicited Copilot links with the same suspicion applied to unfamiliar sign-in and document-sharing links, even when the visible destination appears to be a Microsoft service.
- Track Microsoft 365 Message Center notices and Microsoft Security Response Center advisories, because hosted-service fixes may take effect without a Windows Update or a local software version changing.
Clearing Copilot conversation history, as the submitted report suggests, may reduce what remains visible in a user interface, but it is not a primary mitigation for these disclosed vulnerabilities. It does not correct overly broad Microsoft 365 permissions, block hostile text in an external document, or replace service-side fixes already deployed by Microsoft.
The immediate patching action for EchoLeak, Reprompt and SearchLeak has already occurred. The lasting administrative task is harder: reduce the amount of confidential content any one Copilot-enabled identity can retrieve, then monitor the assistant as a powerful access path rather than as a harmless chat window.
Update: Microsoft reportedly completed a fix for the separate CoSnitch Copilot Personal flaw (August 19, 2026)
Techlicious reports that Microsoft deployed a final fix on August 18 for CoSnitch, another one-click prompt-injection issue affecting Copilot Personal. Varonis Threat Labs reportedly disclosed the flaw to Microsoft in December 2025.
Unlike the earlier Reprompt path, CoSnitch could target data available through Copilot Personal connectors, including Gmail, Google Drive, Google Calendar, Outlook and OneDrive. A crafted link could allegedly open Copilot in an authenticated browser session and execute an attacker-controlled request without a confirmation prompt.
The reported proof of concept accessed email content, calendar data, file metadata and saved chat history, then attempted to send results to an attacker-controlled server. Techlicious says Varonis found no evidence of exploitation before the fix.
Consumer users should review Copilot connector settings and remove services they no longer need. This remains a service-side remediation, not a Windows Update or Microsoft 365 Apps patch.
