Unverified50% confidenceFactExact time
Microsoft subsequently fixed the EchoLeak vulnerability on its side, and public reports state that the vulnerability was not found to have been exploited in real attacks.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/17/2026
First Seen
Valid until: 1/15/2027
Sources
Related Entities
Related Claims
UnverifiedMicrosoft rated the Copilot vulnerability as Low Severity and carried out partial fixes—such as restricting Copilot's ability to render clickable hyperlinks—but the fundamental attack vector for data exfiltration has not been fully eliminated.61% similarUnverifiedIn June 2025, AIM Security disclosed the EchoLeak vulnerability in Microsoft 365 Copilot: an email carrying hidden instructions could make Copilot send sensitive data to an attacker without any user click.59% similarUnverifiedSome people have used LLMs to analyze the curl source code and then mass-generate seemingly professional but actually nonexistent or unexploitable security vulnerability reports through bug bounty platforms such as HackerOne.56% similarUnverifiedWhen vulnerability detection identifies a vulnerability, Inhale also tells the user the corresponding version in which the vulnerability is fixed.55% similarUnverifiedMicrosoft Copilot experienced a zero-click incident in which hidden instructions were encountered while retrieving internal documents, causing private content it could access to be leaked.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1056148API
curl https://kongchang.com/api/v1/knowledge/claims/1056148MCP
get_claim(id=1056148)