Copilot got tricked by a single email and spilled the office secrets, zero clicks required

What happened

Aim Security discovered EchoLeak, a zero-click flaw in Microsoft 365 Copilot that let a crafted email prompt the assistant to search internal documents and leak confidential data. Microsoft says it was fixed and no customers were affected, though Aim said full resolution took five months after new problems surfaced in May.