EchoLeak and the Domino Effect: How Small Flaws Unleash Critical AI Exploits

Arjun Ramakrishnan
AI Security
Published: 30 Jun, 2025

“Sometimes, the smallest crack can bring down the tallest wall.”

Executive Summary

The recent discovery of “EchoLeak” (CVE-2025-32711) in Microsoft 365 Copilot by Aim Labs has sent ripples through the AI security landscape. This was the first known zero-click AI exploit, demonstrating how attackers can automatically exfiltrate sensitive organizational data without any user interaction. EchoLeak is a prime example of an attack chain where multiple seemingly minor vulnerabilities—such as bypassing input filters, link redaction, and Content Security Policies (CSPs)—are strategically combined to achieve a critical outcome: data exfiltration through LLM Scope Violation. This attack leverages the AI agent’s ability to access trusted internal data via untrusted external inputs, breaking the principle of least privilege.

Beyond M365 Copilot, this case highlights a broader concern: the potential for similar attack chains involving the Model Context Protocol (MCP). MCP, often dubbed the “USB-C for AI applications,” standardizes API calls to Large Language Models (LLMs), data sources, and agentic tools. However, its design, including no default authentication and minimal security guidance, creates an expanded attack surface. As LLMs are increasingly connected to both remote and privileged local MCP servers, these servers can become critical attack nodes for malicious code execution, remote access control, and credential theft, even in non-Copilot AI products.

Podcast

The Power of Chained Vulnerabilities: EchoLeak Explained

All podcasts, unless specifically mentioned, are generated by AI using NotebookLM

EchoLeak’s success wasn’t due to a single, glaring flaw but rather a clever orchestration of multiple bypasses. The attack started with a malicious email sent to the victim, designed to trigger an indirect prompt injection without the user’s awareness or any specific interaction. Here’s how the chain unfolded:

XPIA Bypass (Cross-Prompt Injection Attack Classifier): Microsoft had deployed classifiers to prevent prompt injection attacks from reaching Copilot’s underlying LLM. However, the attackers bypassed this by phrasing the email’s malicious instructions as if they were intended for the human recipient, avoiding keywords that would flag it as an AI-targeted prompt.
Link and Image Redaction Bypass: M365 Copilot typically redacts external markdown links and images from chat history to prevent users from clicking malicious links. The attackers discovered that reference-style markdown links and images were not redacted. This allowed them to craft outputs that, when rendered, would automatically attempt to fetch content from an attacker-controlled server.
Content Security Policy (CSP) Bypass using SharePoint and Microsoft Teams: Even with the redaction bypass, a strict CSP on the M365 Copilot webpage restricted image loading to an allowlist of Microsoft domains. The breakthrough came from identifying specific Microsoft SharePoint Online and Teams URLs that acted as proxies. By embedding the attacker’s server URL and exfiltrated data within these legitimate proxy URLs, the browser would make a request to the trusted Microsoft domain, which would then forward the request (including the sensitive data) to the attacker’s server, bypassing the CSP and achieving zero-click data exfiltration.

The core concept underpinning EchoLeak is LLM Scope Violation, a situation where specific instructions originating from untrusted inputs make the LLM access trusted data within its context without explicit user consent. In the case of M365 Copilot, the untrusted malicious email manipulated the LLM (OpenAI’s GPT) to access sensitive information from the user’s Microsoft Graph data (mailbox, OneDrive, SharePoint, Teams chat).

To maximize the success of this indirect prompt injection, attackers employed RAG spraying. By sending a very long email chunked with diverse, seemingly innocuous themes (e.g., “employee onboarding processes,” “HR FAQs”), each chunk occupies a different point in the latent (embedding) space. This strategy significantly increases the likelihood that a user’s query about various topics will retrieve a malicious chunk, injecting the attack payload into the LLM’s context.

MCP Servers: New Attack Nodes for AI Exploits

While EchoLeak specifically targeted M365 Copilot, its principles—especially the chaining of vulnerabilities and the concept of LLM Scope Violation—are highly relevant to other AI applications, particularly those utilizing the Model Context Protocol (MCP).

The MCP is an open protocol designed to standardize API calls to LLMs, data sources, and agentic tools, allowing users to define automated workflows fully driven by LLMs. Its rapid adoption across open-source libraries and integrations (e.g., Claude Desktop, OpenAI’s Agents, Microsoft Copilot, Stripe, Slack, IBM Watson) underscores its growing importance. However, the current MCP design carries a wide range of security risks for end-users.

Crucially, MCP has no authentication by default, and its security guidance is minimal. This fundamental flaw, coupled with its power to enable LLMs to execute commands and access sensitive data, dramatically expands the attack surface. Research indicates that many MCP implementations have vulnerabilities such as command injection (43%), path traversal/arbitrary file reads (22%), and unrestricted URL fetching (30%).

Privileged local MCP servers, such as the Filesystem, Slack, Chroma, and Everything servers natively packaged with Claude Desktop, can become attack nodes. These servers grant LLMs access to critical system functionalities. For instance, a Filesystem MCP server allows operations like read file, write file, and edit file, while a Slack MCP server enables interaction with Slack workspaces.

Industry-leading LLMs like Claude 3.7 and Llama-3.3-70B can be coerced to use tools from default MCP servers, leading to:

Malicious Code Execution (MCE): Attackers inject malicious code into system files, potentially leading to unauthorized access or privilege escalation. For example, Claude can add a netcat command to a user’s bash run configuration, granting remote access upon the next terminal opening.
Remote Access Control (RAC): Attackers gain immediate remote access to the victim’s system. This can involve adding attackers’ SSH keys to ~/.ssh/authorized_keys.
Credential Theft (CT): Attackers exploit access to system files or environment variables to extract sensitive information like API keys. For example, the printEnv tool from the Everything MCP server could be abused to capture environment variables.

Even when LLMs’ guardrails are partially triggered, they may still complete malicious requests, especially if the prompt is not explicitly “harmful”. This highlights that relying solely on LLM guardrails for remediation provides a false sense of security.

Retrieval-Agent Deception (RADE) attacks are multi-MCP server attacks akin to EchoLeak’s poisoned content approach. In a RADE attack, the LLM is not directly prompted with the exploit. Instead, publicly available data is corrupted with MCP-leveraging attack commands, and when an MCP-enabled user’s retrieval agent (like Claude using the Chroma MCP server) queries this data, the malicious commands are retrieved and executed automatically. This can lead to credential theft (e.g., exfiltrating OpenAI and HuggingFace API keys via Slack) or remote access control, all without direct user prompting of the attack. This emphasizes how compromised remote data can turn local, privileged MCP servers into attack nodes.

The EchoLeak vulnerability and the demonstrated exploits against MCP servers serve as critical reminders that in the evolving landscape of AI, security must be a core requirement at every stage of the AI lifecycle. The ability to chain seemingly minor vulnerabilities to achieve critical outcomes like zero-click data exfiltration underscores the need for a holistic defense-in-depth strategy.

Organizations adopting AI agents and protocols like MCP must move beyond superficial security measures. This includes minimizing data exposure, mandating robust authentication for all MCP endpoints, hardening input and output validation, and deploying layered security with real-time monitoring. Tools like McpSafetyScanner are vital for proactively identifying and remediating vulnerabilities in MCP servers before deployment, strengthening guardrails beyond just the LLM’s internal defenses. There are several impementation of security gateways that can protect MCP servers and provide a layer of AuthN/AuthZ. A great example can be found at Lasso Security’s MCP Gateway implementaion https://github.com/lasso-security/mcp-gateway

The re-emergence of fundamental vulnerabilities like command injection in cutting-edge AI architectures signals a regression in security practices that must be urgently addressed. By embracing continuous security auditing, responsible disclosure, and a proactive stance on AI security, organizations can harness the power of generative AI while safeguarding their systems and data from sophisticated attack chains.

And finally, basic cybersecurity hygiene practices such as ensuring sensitive data is not over-shared, credentials is not available to RAG systems and ensuring data governance is carried out alongside the adoption of powerful Agentic RAG systems like M365 Copilot, are critical to mitigating the risks associated with AI agents and protocols like MCP.