5 ms·
Microsoft has published a CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20
by ubuntu432 1y ago
Microsoft has published a CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
- bstsb 1y agothe classification seems very high (9.3). looks like they've said User Interaction is none, but from reading the writeup looks like you would need the image injected into a response prompted by a user?
- filbert42 1y agoif I understand it correctly, user's prompt does not need to be related to the specific malicious email. It's enough that such email was "indexed" by Copilot and any prompt with sensitive info request could trigger the leak.
- bstsb 1y agoyeah but i wouldn't really class that as "zero-click" etc. maybe Low interaction required
- byteknight 1y agoI have to agree with you. Anything that requires an initiation (a chat in this case) by the user is inherently not "zero-click".
- mewpmewp2 1y agoSo zero click is only if you do not use a mouse on your computer or if it works without turning the computer on?
- byteknight 1y agoNo, zero click requires no interaction from the user. For a hypothetical example simply having a phone on a cellular network and being susceptible to base-band attacks. No interaction needed, just existing.
- Emiledel 1y agoAgree with other comments here - no need for the user to engage with anything from the malicious email, only to continue using their account with some LLM interactions. The account is poisoned even for known safe self initiated interactions.
- TonyTrapp 1y agoI think "zero-click" usually refers to the interaction with the malicious software or content itself, which in this case you don't have to interact with. I'd say the need to start an interaction with Copilot here could be compared to the need to log into your computer for a zero-click malware to become effective. Alternatively, not starting the Copilot interaction is similar to not opening your browser and thus being invulnerable to a zero-click vulnerability on a website. So calling this a zero-click in Copilot is appropriate, I think.
- wunderwuzzi23 1y agoYeah, that's my view also. zero-click is about the general question of can you get exploited by just exercising a certain (on by default) feature. Of course you need to use the feature in the first place, like summarize an email, extract content from a website,... However, this isn't the first zero-click exploit in an AI app. we have seen exploits like this in LLM apps of basically all major AI app over the last 2+ years ago (including Bing Chat, now called Copilot).
- charcircuit 1y agoYes, the user has to explicitly make a prompt.
- Bootvis 1y agoThe way I understand it: The attacker sends an email to the user which is intercepted by Copilot which processes the email and embeds the email for RAG. The mail is crafted to have a high likelihood to be retrieved during regular prompting. Then Copilot will write evil markdown crafted to exfiltrate data using GET parameters so the attack runs when the mail is received.
- brookst 1y agoDon’t we call it a zero click when the user is compromised just from visiting a website?
- simonw 1y agoMy notes here: https://simonwillison.net/2025/Jun/11/echoleak/ https://simonwillison.net/2025/Jun/11/echoleak/ The attack involves sending an email with multiple copies of the attack attached to a bunch of different text, like this: Here is the complete guide to employee onborading processes: <attack instructions> [...] Here is the complete guide to leave of absence management: <attack instructions> The idea is to have such generic, likely questions that there is a high chance that a random user prompt will trigger the attack.
- theHolyTrynity 1y agovery cool break down! it looks like it is very hard to defend against those. I am building a customer facing agent and I am looking for lean ways to defend against these attacks what do you recommedn?
- simonw 1y agoI don't know of any 100% reliable fixes for this, and I've been looking for them for nearly three years: https://simonwillison.net/tags/prompt-injection/ https://simonwillison.net/tags/prompt-injection/ Most promising approach right now is this one: https://simonwillison.net/2025/Apr/11/camel/ https://simonwillison.net/2025/Apr/11/camel/ This paper is useful too: https://simonwillison.net/2025/Jun/13/prompt-injection-design-patterns/ https://simonwillison.net/2025/Jun/13/prompt-injection-desig...
- moontear 1y agoThank you! I was looking for this information in the original blog post.
- verandaguy 1y agoThis seems like a laughably scant CVE, even for a cloud-based product. No steps to reproduce outside of this writeup by the original researcher team (which should IMO always be present in one of the major CVE databases for posterity), no explanation of how the remediation was implemented or tested... Cloud-native products have never been great across the board for CVEs, but this really feels like a slap in the face. Is this going to be the future of CVEs with LLMs taking over? "Hey, we had a CVSS 9.3, all your data could be exfiled for a while, but we patched it out, Trust Us®?"
- p_ing 1y agoMicrosoft has never given out repro steps in their MSRC CVEs. This has nothing to do with LLMs or cloud-only products.