EchoLeak Incident in Copilot: Clickless Data Exfiltration from M365
Data can leave the company without a single employee click.
In August 2026, I reviewed Copilot's permissions in our AGAPE Automation Systems tenant. What I found made me revisit the EchoLeak incident and calculate how much one such leak would cost me.
When I first read about EchoLeak, I thought Microsoft had patched the issue and the matter was closed. Then I checked the scope of documents Copilot has access to in our tenant, and I realized that the patch only removes one vector, not the broader access problem.
At AGAPE, from the beginning, we designed Zero-Hallucination to limit the scope of data visible to the model. Not only to avoid hallucinations, but precisely so that in an EchoLeak-type attack, there would be nothing to exfiltrate. Octopus operates on the same principle: the less data the model sees, the lower the machine maintenance cost and the lower the risk.
How much do you really know about what your people paste into AI?
Half of the activity involving pasting into generative AI tools concerns corporate data. Offers, margins, customer emails, payrolls. The other half are ordinary questions, which nevertheless trigger a search of the entire context.
89 percent of logins to AI tools occur outside the control of standard corporate mechanisms. People log in using private accounts, in unsupervised browsers, via plugins in Word or Teams. The owner does not see this in any IT report, because no such report exists.
I myself go to meetings based on referrals and don't have time to manage every tool someone installs. That's why at AGAPE we introduced a simple registry: each AI tool, its permissions, and the scope of data it has access to. Without this registry, the TCO of the machine increases due to hidden items not visible in the subscription.
How EchoLeak exfiltrated data - step-by-step mechanism
The attacker sent an email formatted to appear as relevant material for typical queries about onboarding, HR procedures, or quarterly reports. Without the words AI, Copilot, or prompt, precisely to bypass XPIA classifiers.
The RAG mechanism in Copilot considered the email as context and included its content in LLM processing. The malicious content instructed the model to find the most sensitive data in the current context and place it in a Markdown image URL.
The Copilot client automatically attempted to load the image, sending an HTTP request to the attacker's external server. Data leaked in the URL, without any clicks, without file downloads, without visible user action.
Even companies blocking public chatbots and exclusively using Copilot within their own Microsoft 365 environment remained vulnerable. The attack worked precisely within the closed M365 environment.
LLM Scope Violation as a structural flaw in RAG architecture
EchoLeak was not a single product bug. It is a symptom of a broader class of problems called LLM Scope Violation. Untrusted external data influences the processing of trusted internal information because the model, by definition, mixes both sources with every query.
As long as Copilot searches emails and documents with every question, external content can influence what the system does with internal data. The patch from June 2025 removed one specific vector, but did not change the architecture where RAG combines broad permissions with automatic rendering of external content.
At AGAPE, after EchoLeak, I no longer ask if the tool is secure. I ask how many documents it sees that it shouldn't have access to, and how much a leak of one of them would cost.
How much does one such leak cost - TCO from an architectural perspective
The cost is not limited to the subscription. UOKiK fines can reach 4 percent of annual revenue. Losing one B2B client from referrals means losing a contract worth, on average, several hundred thousand zlotys. The cost of defensive communication and auditing after a leak starts from several thousand zlotys.
At AGAPE, we calculate the cost per completed task. When the model has access to the entire mailbox and all SharePoint files, each task becomes more expensive due to risk. Zero-Hallucination limits this access to the minimum required by the user's role. This keeps the TCO of machine maintenance predictable.
What I checked at AGAPE after EchoLeak
I conducted a permission audit in the tenant. I restricted Copilot's access to mailboxes and folders that are not essential for daily queries. I introduced a rule that every new AI tool goes through a registry with a permission map.
I also checked the automatic loading function for external content. Wherever possible, I disabled the rendering of Markdown images from unknown sources. Microsoft declares that Copilot respects existing permissions, so the narrower the scope, the lower the risk of another similar incident.
Two questions I now ask every AI tool before deployment
I prepared a checklist of five questions I ask every AI tool before allowing it access to company data. Write to me on LinkedIn with the tag content_2026_08_roman, and I'll send it to you.
If you have 20 minutes, I can review the scope of Copilot's permissions in your tenant with you and show you which documents are visible to the model but shouldn't be. You'll find a link to the calendar in the comment below the post.
How many documents in your company have broader permissions than their owner's role requires? If you don't know the answer within 30 seconds, that's your first audit point.
Key takeaways
- The EchoLeak attack exfiltrated data from Microsoft 365 without user interaction, by exploiting automatic Markdown image rendering.
- The incident exemplifies an architectural flaw known as LLM Scope Violation, where RAG indiscriminately mixes untrusted external data with sensitive corporate context.
- Vendor patches only address individual attack vectors, while the permanent solution is architecturally limiting the scope of data visible to the model.
- Implementing an AI tool registry and a strict permission audit in the M365 tenant protects the company from hidden costs and contract losses.
Frequently asked questions (FAQ)
- What is the EchoLeak attack in Microsoft Copilot?
- EchoLeak is a vulnerability in Microsoft Copilot allowing for clickless exfiltration of sensitive data from the Microsoft 365 environment. Malicious content from an external message instructed the model to find sensitive information and send it to the attacker's server via a Markdown image URL. The leak occurred automatically, without file downloads or user action.
- What is the problem with LLM Scope Violation in RAG?
- LLM Scope Violation is a structural flaw in RAG architecture where the model mixes untrusted external data with trusted internal documents. As long as the AI system searches a broad context of emails and files for every query, external content can influence what the model does with confidential data. This makes it impossible to ensure security solely through simple filters.
- Why don't Microsoft updates fully resolve the EchoLeak issue?
- Patches only eliminate specific, detected exfiltration methods, such as rendering certain links. However, they do not change Copilot's fundamental architecture, which combines broad file permissions with automatic processing of external content. If the model has access to too many documents, the risk of context manipulation still exists.
- What are the financial implications of AI-driven data leaks?
- The cost of an incident extends far beyond the subscription fee and includes regulatory fines reaching up to 4% of annual revenue. Data leaks also pose the risk of losing key B2B clients and incur high costs for audits and crisis communication. Limiting AI access to data minimizes this risk and helps maintain a predictable TCO.
- How to secure Microsoft Copilot against data leaks in the company?
- It is necessary to audit permissions in the M365 tenant and restrict Copilot's access exclusively to files and mailboxes essential for a given role. It is also advisable to implement an AI tool registry and disable automatic loading of images from unknown external sources. The smaller the scope of data the model sees, the lower the risk with subsequent vulnerabilities.
Consider what documents and emails would be accessible to a similar tool in your company.