EchoLeak. The access path.
An email nobody opened made Microsoft 365 Copilot leak tenant data. No credential was stolen. The privilege spent was Copilot's own delegated access to the user's mail and Graph data.
The record
Entry point. inbound email, no mention of Copilot or AI, so the injection classifier does not fire.
The identity in the middle. None stolen. The path ran on the signed-in user's own delegated Copilot and Microsoft Graph access, which is what the injected instructions spent.
What was reached. tenant data sent out through allowlisted Microsoft domains.
An email nobody opened made Microsoft 365 Copilot leak tenant data.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| inbound email | Entry | no mention of Copilot or AI, so the injection classifier does not fire |
| RAG retrieval | Step | the mail is pulled into context beside the user's own data |
| delegated Graph access | Step | Copilot reads mail, chat history and org data as the user |
| tenant data | Reached | sent out through Teams and SharePoint URLs already on the CSP allowlist |
Where a breakpoint would have been
The output channel, not the email. A classifier will keep missing a message that never names the assistant. What turned a retrieved mail into a leak is that Copilot could put data into a URL already on the trusted allowlist. Narrowing where generated output may point closes the path after the injection and before the exfiltration.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
4 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
MITRE CVE record, CVE-2025-32711 · Aim Security · SecurityWeek · The Hacker News
Questions, answered.
The two questions this record answers.
What was the entry point in the EchoLeak incident?
The published path starts at inbound email, no mention of Copilot or AI, so the injection classifier does not fire.
What did it reach?
The published path ends at tenant data sent out through allowlisted Microsoft domains.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.