Microsoft fixed a serious vulnerability last month in M365 Copilot, the AI assistant baked into Word, Outlook, Teams, and the rest of the Microsoft 365 suite. The flaw was called EchoLeak. It was the first known attack of its kind: a zero-click exploit, meaning the victim had to do absolutely nothing to be compromised.
Here is how it worked. An attacker sent a regular email to an employee who used Copilot. The email looked harmless. It contained hidden instructions written for the AI, not the human. When the employee later asked Copilot a question, say, about company HR policies or a meeting summary, Copilot would pull together relevant emails to form its answer. In doing so, it picked up the attacker's hidden email and treated those instructions as legitimate commands. It then quietly collected whatever sensitive data was visible to it, including two-factor authentication codes sitting in the inbox, and sent that data to the attacker's server. The employee saw nothing unusual.
Microsoft rated this as maximum severity, scoring 9.3 out of 10 on the standard security risk scale. It was patched on the server side, which means Microsoft fixed it centrally. Employees and IT teams do not need to do anything. There is also no evidence the flaw was exploited by any real attacker before it was discovered and reported by security researchers at Aim Security.
That last part is reassuring. What is not reassuring is the reason this kind of attack is possible in the first place, and why it keeps reappearing.
Copilot, like every other AI assistant of its type, cannot tell the difference between instructions it is supposed to follow and instructions an attacker has hidden inside an email or document. A human reading that email would see ordinary text. The AI sees it as a command. This is the core problem, and it has no clean fix. It is structural, not a coding mistake that can simply be patched away.
Security researchers rank this type of attack, called prompt injection, as the single biggest risk in enterprise AI systems, appearing in a majority of production AI deployments assessed in recent audits. A similar flaw was found in ChatGPT's email-connected agent in late 2025, and a parallel vulnerability was identified in Salesforce's enterprise AI product around the same time, with that company not issuing a public advisory as of the last available reporting.
The scale of exposure matters here. By early 2026, Microsoft had roughly 15 million paid Copilot enterprise seats, with many more employees using the free tier. Accenture alone is rolling out Copilot to around 743,000 staff. Copilot has access to emails, SharePoint files, Teams chats, calendar entries, and internal documents. An attacker who can manipulate it does not need a password. They inherit whatever the employee can see.
For business operators, the practical question is not whether to stop using these tools. The productivity gains are real and the patch is in place. The question is what governance sits around them. AI assistants that can read your entire company's communications are a target. Treating them with the same caution applied to any system with broad data access is the sensible response. Knowing what data Copilot can actually reach in your organisation, and whether that access is tighter than it needs to be, is a reasonable place to start.