{"id":"d66e3400-c560-4600-8bb5-dcad1ffe5041","arxiv_id":"2509.10540","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A secondary case study of the publicly disclosed EchoLeak zero-click prompt injection vulnerability in Microsoft 365 Copilot, plus defense recommendations, with no new experimental evidence.","lead":"EchoLeak is a vulnerability in Microsoft 365 Copilot that let an attacker who sends one email steal internal data automatically, without the user clicking anything. This paper analyzes that publicly disclosed attack chain and recommends security fixes, but it does not reproduce the attack or run any experiments.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central attack mechanics rest entirely on Aim Labs's disclosure; a single re-derivation test of the XPIA/TEAMS-proxy steps would decide if the paper's technical chain is sound or merely reported.","rationale":"The reader's weakest_assumption is exactly the load-bearing concern: the paper's technical mechanism is entirely dependent on Aim Labs' disclosure, with no reproduction and an explicit admissions of inferential conclusions. My independent reading of the full text confirms this, and I find no other more fundamental flaw. The paper's other weaknesses—the internal contradiction in Table 3, the novelty question—are real but secondary. The central descriptive claim (that a zero-click prompt injection data exfiltration occurred in production Copilot) is externally corroborated by CVE-2025-32711, Microsoft's confirmation, and Aim Labs' disclosure, so I would not reject or unverdict the paper. However, ACCEPT would be premature while the technical chain has not been independently verified and the 'in our tests' wording overstates the evidence. The paper itself promises a sandbox reproduction in Future Work, which is the natural test. I keep the reader's CONDITIONAL verdict: the paper should be accepted only with explicit labeling of which claims rest on Aim Labs' disclosure versus direct analysis, and correction of Table 3's caption.","tokens_in":10126,"tokens_out":1593,"duration_ms":12535,"concrete_test":"Independently re-derive the two most unusual steps from primary documentation: (1) Check the Aim Labs disclosure (and, if possible, Microsoft MSRC advisory) for a packet capture or server log showing a request arriving at an attacker-controlled URL containing the exfiltrated secret via asyncgw.teams.microsoft.com/urlp; (2) In a self-hosted Copilot-like renderer (as the paper's Future Work proposes), test whether a reference-style Markdown image (![alt][ref] with [ref]: https://...?data=secret) is auto-fetched by the client while an inline image URL is blocked; if the reference-style form is stripped or the Teams endpoint refuses arbitrary redirect targets, the attack chain as described collapses to a one-click exfiltration and 'zero-click' is unsupported.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central technical claim—that EchoLeak chains an XPIA classifier bypass, a reference-style Markdown redaction gap, image auto-fetch, and a Teams proxy (asyncgw.teams.microsoft.com/urlp) to achieve zero-click exfiltration—is taken entirely from Aim Labs' public disclosure. The authors state in Limitations that they 'did not reproduce the attack or run any experiments' and that 'proprietary filters and model differences mean some conclusions are inferential.' Every step of the chain therefore rests on a single external source, with no independent verification of the most unusual and load-bearing components: (a) that the reference-style Markdown form actually survives Copilot's output sanitizer, and (b) that the Teams proxy endpoint both accepts an arbitrary URL parameter and performs a server-side fetch whose result is delivered to the attacker. If Aim Labs' account is accurate, the paper is a faithful secondary analysis; if either of those steps is misdescribed or was vendor-specific detail omitted by Microsoft, the paper's four-step mechanism, and its stronger claim of 'full privilege escalation across LLM trust boundaries,' is unsupported. The Table 3 caption ('in our tests') conflicts with the Limitations statement and should not be read as experimental evidence. This concern does not dispute the existence or severity of CVE-2025-32711; rather, it targets the paper's unsupported transition from 'Aim Labs claims' to 'we demonstrate/analyze' the mechanism.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents a case study of EchoLeak (CVE-2025-32711), a claimed zero-click prompt injection vulnerability in Microsoft 365 Copilot. Based on public disclosures by Aim Labs and Microsoft, the authors describe a four-step attack chain: bypassing the XPIA classifier, evading link redaction via reference-style Markdown, exploiting automatic image fetching, and abusing a Microsoft Teams preview API as a CSP-allowed proxy for exfiltration. The paper also proposes a set of engineering mitigations and derives lessons learned for securing LLM-integrated enterprise systems. The authors explicitly state that they did not reproduce the attack or run experiments, and that some conclusions are inferential.","tokens_in":10329,"tokens_out":4662,"duration_ms":37378,"significance":"If the attack chain is accurately described, the paper documents a significant real-world security event: a remote, unauthenticated, zero-click data exfiltration from a major production LLM assistant. The paper's main value is as a structured secondary analysis, assembling a threat model, kill-chain diagram, and mapping to security frameworks (OWASP, NIST SP 800-53). The mitigation discussion, while largely standard, is sensibly organized and includes a useful theoretical matrix. However, the paper offers no independent verification of the attack mechanics, no experiments, and no new empirical data; its central technical claims rest entirely on a single third-party disclosure. The authors are commendably transparent about these limitations, but the manuscript does not currently meet the evidentiary bar for presenting the attack chain as established fact.","major_comments":[{"comment":"The paper states in Limitations that 'we did not reproduce the attack or run any experiments' and that 'some conclusions are inferential,' yet the main analysis in the EchoLeak Analysis section presents the four-step chain (XPIA bypass, reference-style Markdown, image auto-fetch, Teams proxy) as established fact, citing only Aim Labs. Because these steps are load-bearing for the paper's central claim of a zero-click exploit, the manuscript must either (a) provide independent verification (e.g., a sandbox reproduction or a direct test of the specific sanitizer and proxy behaviors), or (b) reframe the contribution as a secondary account that explicitly attributes each step to the original disclosure and marks the inferential status throughout. As written, the epistemic reliance on a single source is concealed by the assertive prose.","section":"Limitations & Future Work; EchoLeak Analysis"},{"comment":"The caption of Table 3 states that 'Cells marked with ✓ indicate full coverage in our tests; × indicates at least one bypass,' but the Limitations section says the authors 'did not reproduce the attack or run any experiments.' This is an internal contradiction on a point that directly affects the credibility of the mitigation matrix. The caption must be corrected to indicate that the mapping is a theoretical assessment, not the result of testing.","section":"Table 3"},{"comment":"The zero-click claim hinges on the assertion that the Teams asynchronous preview API (asyncgw.teams.microsoft.com/urlp) accepts an arbitrary URL parameter and performs a server-side fetch. The paper provides no evidence for this behavior beyond Aim Labs' description. If this step is misdescribed, the attack is not zero-click but one-click. The authors should either supply a minimal verification (e.g., a controlled probe of the endpoint or documentation evidence) or explicitly state that this step is unverified and inferred from a single third-party source.","section":"EchoLeak Analysis, Step 4: CSP Bypass"},{"comment":"The paper claims that EchoLeak is 'the first real-world zero-click prompt injection exploit' in a production LLM system. This uniqueness claim is not independently substantiated; it is taken from Aim Labs' reporting. To support the claim, the paper should either provide a survey of prior incidents to confirm novelty or qualify the claim with a clear attribution (e.g., 'according to Aim Labs'). As it stands, the claim is stronger than the evidence the paper itself marshals.","section":"Abstract and Introduction"}],"minor_comments":[{"comment":"The text repeatedly uses 'OW ASP' where the correct name is 'OWASP' (e.g., Abstract, Introduction, and Table 2).","section":"Throughout"},{"comment":"Figures 1 and 2 are referenced in the main text but are not present in the manuscript, so the reader cannot access the diagrams that are central to the attack description.","section":"Figures 1 and 2"},{"comment":"There are several typos: 'adversary doe not have access' (Threat Model), 'resist xecuting' (Discussion), 'SSRFi' (Content Security Policies), and 'iszero-click' (EchoLeak Analysis).","section":"Various typos"},{"comment":"The reference list is incomplete: several entries (Aim Labs 2025, Center 2025, Rabbit 2025, Microsoft Corporation 2025) lack URLs and access dates, making verification difficult.","section":"References"},{"comment":"In Table 1, the January 2025 row lists multiple sub-events but the text says only that Aim Labs 'created a working proof of concept'; the table and narrative should be aligned.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"This is a borderline case for a research venue. The paper is essentially a well-written secondary analysis of a third-party vulnerability disclosure. Its value depends entirely on the accuracy of the original Aim Labs report, which the authors did not verify. If the journal publishes case studies of public incidents, the paper is acceptable after major revisions that fix the internal contradiction and clearly attribute the technical chain to the primary source. I would urge the authors to collaborate with Aim Labs or reproduce the attack in a sandbox to strengthen the evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The useful thing here is the synthesis, not the research. This is a well-organized case study of a publicly disclosed vulnerability (CVE-2025-32711) that Microsoft patched before disclosure. The authors have done a decent job condensing Aim Labs' report, the timeline, the framework mappings, and the generic mitigation advice into a readable package. If I needed to brief a non-specialist on EchoLeak quickly, this paper would save time.\n\nWhat it is not: a new empirical result. The authors say in Limitations that they did not reproduce the attack or run experiments, and every technical step of the chain is inherited from Aim Labs. That alone is fine for a case study, but the paper repeatedly frames itself as an analysis and demonstration. The abstract's \"full privilege escalation across LLM trust boundaries\" is overwrought for a data exfiltration via an email-triggered image fetch; nothing was escalated in any conventional sense. The bigger problem is Table 3, whose caption asserts that checkmarks indicate \"full coverage in our tests.\" That contradicts the Limitations statement and should be read as a theoretical mapping, not experimental evidence. The caption must be corrected before this goes anywhere serious.\n\nThe stress-test note is right: the most load-bearing steps of the chain—that reference-style Markdown bypasses Copilot's redaction and that the Teams proxy actually fetches an arbitrary URL server-side—rest entirely on a single external account. The paper does flag this as inferential, but the body sometimes slips into \"we demonstrate\" language. That is a framing issue, not a fatal one. The CVE and Microsoft's acknowledgment externally corroborate that EchoLeak existed and was fixed; what is not corroborated independently is the precise four-step mechanism.\n\nOn balance: the paper is honest about most of its limitations, it cites the relevant literature, and it does not invent data. The citation pattern looks reasonable. Its value is pedagogical and as a reference summary. For a research venue, novelty is low and the overclaims need adjusting. I would send it to peer review only as a case-study note if the authors fix Table 3 and systematically attribute the attack chain to Aim Labs. For a workshop or industry venue it is acceptable with minor revision. I would not cite it in my own work beyond maybe pointing to it as a secondary summary, and I would not bring it to reading group unless the goal is to critique how secondary accounts can overstate their contribution.","headline":"A tidy secondary writeup of a real CVE; the value is the synthesis, not new findings, and the Table 3 'in our tests' claim must be fixed.","tokens_in":10904,"tokens_out":1563,"would_cite":false,"duration_ms":16672,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"EchoLeak is a zero-click prompt injection exploit in Microsoft 365 Copilot that the paper presents as the first confirmed real-world case of a production LLM assistant being weaponized to exfiltrate data.","keywords":["prompt injection","zero-click exploit","LLM security","Microsoft 365 Copilot","data exfiltration","retrieval-augmented generation","content security policy","indirect prompt injection"],"falsifier":"Send a crafted email containing hidden instructions to a test tenant, have the victim invoke Copilot to summarize recent email, and inspect the rendered output: if the reference-style image link is redacted, the client refuses to fetch it, or the Teams preview endpoint rejects the external URL, the described chain fails at that step. A reproduction showing that the XPIA classifier flags the crafted phrasing, or server logs showing the proxy refused the request, would also falsify the paper's central claim.","tokens_in":1556,"feed_emoji":"🔓","tokens_out":1944,"duration_ms":66198,"temperature":0.7,"pith_summary":"The paper argues that EchoLeak (CVE-2025-32711) is the first confirmed real-world zero-click prompt injection exploit in a production LLM system: a single attacker-crafted email, when ingested by Microsoft 365 Copilot during ordinary retrieval, can make Copilot embed sensitive data from the user's context into a Markdown image URL that the client automatically fetches, exfiltrating the data to the attacker with no user interaction. It analyzes the four-step chain that bypasses Microsoft's prompt-injection classifier, link redaction, image auto-fetch restrictions, and content security policy via an allow-listed Teams URL-preview proxy. If correct, the case moves prompt injection from a theoretical risk to a practical, high-severity vulnerability class in enterprise AI assistants. The paper also derives engineering defenses, such as prompt partitioning, provenance-based access control, output policy gates, and strict content security policies, along with general lessons for secure AI copilot design.","feed_headline":"Zero-click prompt injection can silently exfiltrate Copilot data","feed_subtitle":"A crafted email chains four filter bypasses to steal data with no user clicks, the paper argues.","key_machinery":"The load-bearing mechanism is a chain of four bypasses around a single rendered message. The central object is the reference-style Markdown link (for example, `[text][ref]` with a separate `[ref]: URL` line), which the paper says Microsoft's link redaction did not recognize, unlike inline `[text](URL)` links. That link is rendered as an image (`![alt][ref]`), causing the browser or client to auto-fetch the URL without user action. The final piece is an allow-listed Microsoft Teams asynchronous preview proxy that fetches arbitrary URLs on behalf of the client, turning a blocked external domain into a permitted exfiltration channel. Together these convert Copilot's normal helpful behavior, retrieving, summarizing, and rendering content, into a data-egress pipeline.","core_discovery":"On the paper's account, EchoLeak is an 'LLM scope violation': an external attacker, without any authenticated access to Copilot, sends the victim an email whose hidden instructions survive retrieval and classification. When the victim later asks Copilot to summarize or search internal content, Copilot follows the embedded instructions and produces an answer containing a reference-style Markdown image link whose URL encodes the sensitive material. The chat client renders the answer and automatically fetches the image; the fetch targets a Microsoft Teams URL-preview endpoint that is on the content-security-policy allowlist and that proxies the request to the attacker's server, delivering the secret in the request path. The paper claims that the XPIA classifier missed the subtly phrased injection, that reference-style links evaded the output redaction designed for inline Markdown links, and that no user click is needed at any point. The result, per the paper, is the first demonstrated zero-click data exfiltration through a production LLM assistant, assigned CVE-2025-32711 and closed by a server-side fix.","pith_inferences":["The same chain likely applies to any RAG assistant whose markdown renderer auto-fetches images and whose output sanitizer only handles inline links, so reference-style link gaps are a generic risk rather than a Copilot-specific flaw.","The Teams-proxy step suggests a broader pattern: any allow-listed URL-preview or unfurl endpoint can serve as an exfiltration proxy, so CSP allowlists alone do not establish a real network boundary.","A testable extension is to reproduce the attack in a sandboxed Copilot-like system with a monotonic filter baseline; if reference-style image links survive sanitization, the core bypass is confirmed independently of Microsoft's proprietary details.","Because the exploit requires zero clicks, the barrier to mass exploitation is low, which makes defense-in-depth and egress monitoring more urgent than user-awareness training."],"forward_implications":["Prompt injection in production LLM assistants must be treated as a practical, high-severity vulnerability class rather than a theoretical concern.","Single-layer defenses, such as input classifiers, link redaction, and CSP allowlists, are insufficient because each can be bypassed under modest adversarial pressure.","External content like incoming email should be isolated from internal context by provenance, with internal-only retrieval as the default.","Output rendering must be constrained to a safe subset that blocks external images and arbitrary URLs, paired with strict network egress controls.","Continuous adversarial red-teaming of retrieval, rendering, and egress paths is necessary for AI copilots."],"supporting_citations":[{"why":"Source of the full EchoLeak attack chain, including all four bypass steps and the zero-click exfiltration mechanism.","marker":"Aim Labs 2025"},{"why":"Confirms CVE-2025-32711 and the vulnerability's official assessment for Microsoft 365 Copilot.","marker":"NIST NVD 2025"},{"why":"Microsoft Security Response Center advisory confirming the CVE and the server-side remediation.","marker":"Center 2025"},{"why":"Press analysis confirming the zero-click characterization and the absence of in-the-wild exploitation.","marker":"Lakshmanan 2025"},{"why":"Defines goal hijacking and prompt leaking, the attack taxonomy that EchoLeak instantiates.","marker":"Perez and Ribeiro 2022"},{"why":"Demonstrated indirect prompt injection in real-world LLM-integrated applications, the baseline EchoLeak extends.","marker":"Greshake et al. 2023"},{"why":"Documented real-world risks including data exfiltration and remote code execution in LLM-integrated apps, supporting severity.","marker":"Liu et al. 2023"},{"why":"Introduces spotlighting, a source-tagging mitigation the paper recommends for prompt partitioning.","marker":"Hines et al. 2024"}],"fun_headline_variants":["EchoLeak: zero-click email exploit steals Copilot data","Zero-click Microsoft Copilot data theft via single email","One crafted email, zero clicks: Copilot leaks data","EchoLeak exploit: zero-click prompt injection exfiltrates Copilot"],"cache_read_input_tokens":13056,"weakest_assumption_plain":"The paper assumes the public disclosure's technical account of the four bypasses is accurate, since it never reproduces the attack and acknowledges that proprietary filters and model differences make some conclusions inferential.","fun_headline_variants_meta":{"raw":{"variants":["EchoLeak: zero-click email exploit steals Copilot data","Zero-click Microsoft Copilot data theft via single email","One crafted email, zero clicks: Copilot leaks data","EchoLeak exploit: zero-click prompt injection exfiltrates Copilot"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000896,"raw_usage":{"total_tokens":3880,"prompt_tokens":984,"completion_tokens":2896,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":600,"completion_tokens_details":{"reasoning_tokens":2823}},"tokens_in":600,"tokens_out":2896,"duration_ms":19291,"temperature":1.0,"reasoning_tokens":2823,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:21:23.572679+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Send a crafted email containing hidden instructions to a test tenant, have the victim invoke Copilot to summarize recent email, and inspect the rendered output: if the reference-style image link is redacted, the client refuses to fetch it, or the Teams preview endpoint rejects the external URL, the described chain fails at that step. A reproduction showing that the XPIA classifier flags the crafted phrasing, or server logs showing the proxy refused the request, would also falsify the paper's central claim.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Source of the full EchoLeak attack chain, including all four bypass steps and the zero-click exfiltration mechanism."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Confirms CVE-2025-32711 and the vulnerability's official assessment for Microsoft 365 Copilot."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Microsoft Security Response Center advisory confirming the CVE and the server-side remediation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Press analysis confirming the zero-click characterization and the absence of in-the-wild exploitation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces spotlighting, a source-tagging mitigation the paper recommends for prompt partitioning."}],"review_version":2}