CVE-2025-32711

CVE-2025-32711 is a publicly catalogued security vulnerability (a CVE, short for Common Vulnerabilities and Exposures, which is the standard numbering system for publicly disclosed software flaws) affecting Microsoft 365 Copilot. The flaw, nicknamed EchoLeak by its discoverers, allowed an attacker to send a crafted email that caused the AI assistant to pull sensitive data from a user's environment and transmit it out without the user clicking anything. For compliance and risk teams, it is a concrete example of how AI tools with broad access to corporate email, files, and chat can become data exfiltration paths, and it bears directly on vendor risk reviews and data loss prevention controls.

1 item

ResearchGlobal2026-10-28

Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat

CSO Online has cataloged ten attack techniques used against enterprise AI infrastructure. These include a fake MCP server impersonating Postmark and malware hiding attacker commands inside the OpenAI Assistants API. CVE-2025-32711 is a flaw in Microsoft 365 Copilot that lets attackers steal data via email. The real attack surface has shifted to AI tooling, agent permissions, and supply chain integrity. Most enterprise AI governance programs remain focused on model-level risks and have not kept pace.

agentic AI MCP servers prompt injection AI supply chain Microsoft Copilot OpenAI CVE-2025-32711 enterprise security