Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction

A zero-click AI vulnerability, dubbed EchoLeak (CVE-2025-32711), has been identified in Microsoft 365 Copilot, enabling unauthorized data exfiltration via malicious prompts embedded in content like emails; no user interaction is required, and the vulnerability has been addressed by Microsoft in its June 2025 Patch Tuesday. Separately, tool poisoning attacks (TPA) and Full-Schema Poisoning (FSP) targeting the Model Context Protocol (MCP) pose risks to AI agents by manipulating tool schemas to access sensitive data, while MCP rebinding attacks exploit Server-Sent Events (SSE) to access internal resources and exfiltrate confidential data, highlighting critical security concerns in AI-driven automation and agentic applications.

Analysis

A critical-rated (CVSS 9.3) zero-click AI vulnerability, EchoLeak (CVE-2025-32711), was identified in Microsoft 365 Copilot, allowing potential unauthorized data exfiltration without user interaction. Microsoft (MSFT) has addressed this vulnerability, which involved an LLM Scope Violation leading to indirect prompt injection, prior to any known malicious exploitation. The attack, discovered by Aim Security, could leverage Copilot's retrieval-augmented generation (RAG) engine to leak sensitive data via embedded prompts in content like emails. This specific vulnerability underscores broader security challenges in AI, as further evidenced by CyberArk's (CYBR) disclosure of tool poisoning attacks (TPA) and Full-Schema Poisoning (FSP) targeting the Model Context Protocol (MCP). These MCP vulnerabilities exploit the protocol's trust model, potentially allowing attackers to manipulate AI agents into accessing sensitive information by poisoning tool schemas. The article also highlights risks within the MCP client-server architecture, such as a flaw in a GitHub MCP integration enabling agent hijacking, and MCP rebinding attacks that exploit Server-Sent Events (SSE) for DNS rebinding to access internal MCP servers, although SSE was deprecated in November 2024 due to such risks. These findings collectively point to an evolving threat landscape where the increasing autonomy and connectivity of AI agents create new, complex security blind spots that require robust mitigation strategies beyond simple patches, including granular permission controls and continuous auditing. The overall sentiment surrounding these disclosures is moderately negative, particularly for Microsoft, though CyberArk's role in uncovering vulnerabilities could be perceived positively for its expertise.

Key Decisions for Investors

• Investors in Microsoft (MSFT) should acknowledge the patch for EchoLeak but remain vigilant regarding the ongoing security challenges inherent in its expanding AI product suite, which may necessitate increased R&D and security expenditure.
• CyberArk's (CYBR) identification of sophisticated AI vulnerabilities like Full-Schema Poisoning could enhance its reputation and market position in the growing AI cybersecurity sector, potentially presenting a favorable outlook for the company.
• The emergence of complex threats such as LLM Scope Violations, tool poisoning, and MCP rebinding attacks highlights a significant market opportunity for specialized AI security firms and solutions, suggesting a potential growth area for investment.
• Portfolio managers with exposure to companies heavily reliant on or developing AI agentic applications should press for enhanced due diligence on their security postures, specifically concerning protections against the novel attack vectors detailed.