Microsoft 365 Copilot has come up in almost every tenant workshop I've run this year, but the EchoLeak Copilot disclosure in June 2025 (CVE-2025-32711) still caught my attention. It was a zero-click AI command injection flaw, so no user had to do anything. Carefully crafted emails or documents could manipulate Copilot's context and make it leak data or behave in unexpected ways. Microsoft fixed the issue server-side quickly. There was no evidence of exploitation, and customers didn't need to take any action. So on paper, no crisis. I still read EchoLeak as a warning. Indirect prompt injection, also called cross-prompt injection attacks (XPIA), is now a practical risk for any organization that uses AI assistants. In this post I look at what actually decides the blast radius, and why governance, data minimization and monitoring will still matter once this vulnerability has dropped out of the news.

EchoLeak abused the context Copilot pulls from your own content

This was not a classic exploit built on dangerous attachments or macro viruses. EchoLeak Copilot worked because Microsoft 365 Copilot grounds its answers in your emails, files and chats. Malicious prompt fragments hidden in routine messages or documents could hijack Copilot's behaviour, either leaking sensitive data or getting around internal instructions, and nobody had to click anything. The Microsoft advisory for CVE-2025-32711 made it clear that this was a back-end issue, resolved immediately for all tenants across Microsoft's infrastructure. The debate it started in the industry goes much further, though. As long as AI assistants process user-generated content with elevated access, indirect prompt injection will remain a risk for them. This particular hole is closed, but the underlying problem hasn't gone anywhere.

Data minimization limits what an EchoLeak-style flaw can expose

I see the same pattern in practice again and again. The thing that limits the impact of an EchoLeak-style issue isn't the model or a code update. It's the data Copilot is allowed to see. Confidential files sitting in broadly shared SharePoint sites or Teams channels, or permissions that nobody has reviewed for years, make the potential blast radius of any AI prompt injection huge. That's where good old least privilege and minimization come in. Restricted SharePoint Search, sensible sharing policies and regular user education make a real difference, because whatever Copilot can't see can't be exposed if things go wrong. Technical Copilot controls only work as well as the data discipline underneath them. If you let oversharing run unchecked, no model patch will protect you over time.

Practical tip: Review permissions on your most sensitive SharePoint libraries at least once a quarter, and especially after large projects or organizational changes. Tighten the sharing policies for these locations. It's the simplest and most concrete way to reduce the attack surface for AI features like Copilot.

The following simple diagram shows how a malicious prompt can travel from ordinary content into Copilot:

direction TD
Source["Email/Doc with injected prompt"] --> Store["Mailbox/SharePoint"]
Store --> Copilot["Microsoft 365 Copilot"]
Copilot --> AI["AI model"]
AI --> Response["User gets answer"]

Figure: Indirect prompt injection path via EchoLeak Copilot (simplified attack flow)

Sensitivity labels and DLP only protect Copilot when you apply them consistently

It's tempting to say "just label everything Sensitive!", but it rarely works out that neatly. Sensitivity labels and DLP (Data Loss Prevention) rules in Microsoft Purview are mature tools for controlling access by AI and by users (Purview docs). They only help if you apply them carefully and consistently. Missing, inconsistent or overly broad labels give you a false sense of security. Copilot may still surface confidential content, and DLP policies may miss the flows that matter. In the secure tenants I work with, the approach that holds up is a focused label taxonomy combined with modern DLP tuned for AI scenarios. If you haven't revisited your strategy since you rolled out Copilot, do it now. Otherwise you're relying on luck rather than policy. My post Copilot and sensitivity labels: How data stays protected goes into the practical details.

Purview Audit logs Copilot interactions, though with less detail than file logs

Even though EchoLeak wasn't exploited in the wild, you still have forensic and compliance requirements. Purview Audit (Premium) now logs Copilot interactions and shows which user accessed which context and when. That's a big step forward for transparency. You need Microsoft 365 E5 or Purview Audit Premium, plus the right audit settings turned on. The audit trail is less granular than file activity logs, but it's good enough to spot unusual Copilot activity and to support incident response. I cover the details and the pitfalls I've run into in Copilot retention and audit: What really happens to your prompts?.

DSPM for AI shows Copilot exposures before the next EchoLeak hits

Data Security Posture Management (DSPM) applied to AI is one of the developments I find most promising. Microsoft Purview now goes beyond generic file exposure and surfaces AI-specific risks and Copilot access patterns (Purview DSPM for AI). Once you know where sensitive data lives, who can access it and how Copilot could reach it, you can reduce the blast radius ahead of time, even if the next prompt injection vulnerability hasn't been found yet. In my view, DSPM, labels, DLP and regular permission reviews together are still the most effective answer to AI data risks, and none of them depend on a patch.

EchoLeak only becomes a crisis when you ignore governance

EchoLeak Copilot disappeared from the headlines within a few days, but the core risk is still there. AI introduces a new attack vector that software fixes alone won't close. If you're relaxed about oversharing and permissions, every AI integration is a gamble. My conclusion is simple. Data governance, well-designed sensitivity labels, ongoing auditing and user awareness are what actually protect you, not another round of emergency patches. If you want to run Copilot securely and with confidence, you have to get these basics in place. If you don't, the next EchoLeak is only one prompt injection away.